Inconsistent URL Decoding in @hono/node-server Affects Static File Access

CVE-2026-29087

What is CVE-2026-29087?

The @hono/node-server is susceptible to an authorization bypass issue stemming from inconsistent URL decoding. This vulnerability arises when static file serving is used in conjunction with route-based middleware protections, such as those for securing /admin/* endpoints. Specifically, encoded slashes (%2F) can lead to discrepancies between how routing and middleware match URLs against static file resources. As a result, potentially unauthorized users may access protected static files when the middleware fails to execute as intended. This critical issue has been resolved in version 1.19.10, emphasizing the importance of keeping software up to date to mitigate such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References