Inconsistent URL Decoding in @hono/node-server Affects Static File Access
CVE-2026-29087

7.5HIGH

Key Information:

Vendor

Honojs

Status
Node-server
Vendor
CVE Published:
6 March 2026

What is CVE-2026-29087?

The @hono/node-server is susceptible to an authorization bypass issue stemming from inconsistent URL decoding. This vulnerability arises when static file serving is used in conjunction with route-based middleware protections, such as those for securing /admin/* endpoints. Specifically, encoded slashes (%2F) can lead to discrepancies between how routing and middleware match URLs against static file resources. As a result, potentially unauthorized users may access protected static files when the middleware fails to execute as intended. This critical issue has been resolved in version 1.19.10, emphasizing the importance of keeping software up to date to mitigate such vulnerabilities.

Affected Version(s)

node-server < 1.19.10

References

https://github.com/honojs/node-server/security/advisories...
x_refsource_CONFIRM
https://github.com/honojs/node-server/commit/455015be1697...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.