CWE-174: Double Decoding of the Same Data
The product decodes the same input twice.
A kind of CWE-675 Multiple Operations on Resource in Single-Operation Context.
From the CWE List. © The MITRE Corporation.
Newest
- mongodb database tools mongorestore may restore encoded collection names into an unintended collection 2.1 Low
- honojs node-server @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths 5.3 Medium
- labstack echo Echo: Static Middleware Double-Unescape Path Traversal 5.9 Medium
- honojs hono Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths 5.3 Medium
- honojs hono Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding 6.9 Medium
- litespeed technologies web server, litespeedtech litespeed web server +1 more LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a... 9.4 Critical
- canva Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor... 4.3 Medium
- fast-uri fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding 7.5 High