CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118663?
CVE-2026-118663 is a medium-severity vulnerability in honojs node-server, published on 28 Oct 2026.
Official description
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.
Weakness: CWE-174
Which versions are affected by CVE-2026-118663?
2 open source packages ship an affected version, including @hono/node-server.
| Package | Affected | Fixed in |
|---|---|---|
@hono/node-server npm | From 1.19.10 | 2.1.3 |
@hono/node-server npm | From 1.19.10 | 2.1.3 |
How do I fix CVE-2026-118663?
Upgrade @hono/node-server to 2.1.3 or later.
Is CVE-2026-118663 being exploited?
There is no known exploitation of CVE-2026-118663 in the wild and no public exploit code.
Sources
Also known as GHSA-rmxm-3fg6-px4f, MINI-48rv-78f7-7x9x.