Directory Traversal Vulnerability in Hono Application on Node.js

CVE-2026-118663

What is CVE-2026-118663?

The Hono application on Node.js is affected by a directory traversal vulnerability due to a flaw in the serveStatic feature, where the request path is decoded multiple times. This allows an unauthenticated attacker to exploit malformed percent-encoded sequences to bypass middleware controls on protected static prefixes, facilitating unauthorized access to files within the static root directory. Importantly, this vulnerability does not allow traversal beyond the configured static root. The issue has been resolved in node-server version 2.1.3.

References