{"id":"CVE-2026-29087","aliases":["CLSA-2026-1793207049","EUVD-2026-10047","GHSA-wc8c-qw6v-h7f6"],"status":"published","title":"@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","description":"@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00363,"percentile":0.30556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-03-04T20:05:49Z","modified":"2026-10-28T19:45:11Z","fixes":[{"ecosystem":"npm","package":"@hono/node-server","fixed_in":["1.19.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@hono/node-server","fixed_in":["1.19.9-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.9-tuxcare.0"},{"fixed":"1.19.9-tuxcare.1"}]}],"versions":["1.19.9"]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"}]}]}],"products":[{"vendor":"hono","product":"node-server"},{"vendor":"honojs","product":"node-server"}],"references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-wc8c-qw6v-h7f6","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29087","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wc8c-qw6v-h7f6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29087.json","tags":["advisory"]},{"url":"https://github.com/honojs/node-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-29087","title":"@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","description":"@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.","status":"published","published":"2026-03-06T17:03:30.412Z","modified":"2026-03-06T18:02:36.517Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-10047","description":"@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.","status":"published","published":"2026-03-06T17:03:30Z","modified":"2026-03-06T18:02:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:07.686491Z"}],"ghsa":[{"id":"GHSA-wc8c-qw6v-h7f6","title":"@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","description":"## Summary\n\nWhen using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), inconsistent URL decoding can allow protected static resources to be accessed without authorization.\n\nIn particular, paths containing encoded slashes (`%2F`) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served.\n\n## Details\n\nThe routing layer and the node-server static handler normalize request paths differently. The router preserves `%2F` as a literal string when matching routes, while the static handler decodes `%2F` into `/` before resolving the filesystem path.\n\nExample request:\n\n- `/admin%2Fsecret.html`\n\nThis may:\n- fail to match middleware intended for `/admin/*`, but\n- still be resolved by the static handler as `/admin/secret.html` under the configured static root.\n\nThis does not allow access outside the configured static root and is not a path traversal vulnerability.\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization protections for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths under the same static root may have exposed those resources.","status":"published","published":"2026-03-04T20:05:49Z","modified":"2026-03-06T22:43:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2026-29087","description":"@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.","status":"published","published":"2026-03-06T18:16:19.757Z","modified":"2026-06-17T10:29:34.687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-29087","title":"@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","description":"@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.","status":"published","published":"2026-03-06T17:03:30.412Z","modified":"2026-10-28T02:31:08.231593022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-wc8c-qw6v-h7f6","title":"@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","description":"## Summary\n\nWhen using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), inconsistent URL decoding can allow protected static resources to be accessed without authorization.\n\nIn particular, paths containing encoded slashes (`%2F`) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served.\n\n## Details\n\nThe routing layer and the node-server static handler normalize request paths differently. The router preserves `%2F` as a literal string when matching routes, while the static handler decodes `%2F` into `/` before resolving the filesystem path.\n\nExample request:\n\n- `/admin%2Fsecret.html`\n\nThis may:\n- fail to match middleware intended for `/admin/*`, but\n- still be resolved by the static handler as `/admin/secret.html` under the configured static root.\n\nThis does not allow access outside the configured static root and is not a path traversal vulnerability.\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization protections for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths under the same static root may have exposed those resources.","status":"published","published":"2026-03-04T20:05:49Z","modified":"2026-09-10T03:50:41.582966467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"CLSA-2026-1793207049","title":"TuxCare security update for @hono/node-server (1 CVE)","description":"TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.9-tuxcare.1.","status":"published","published":"2026-10-28T17:04:09Z","modified":"2026-10-28T19:45:11.114143799Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}