Vulnerability in Honojs Node-Server
CVE-2026-118663
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.
Published .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Honojs Node-Server — versions > = 1.19.10, < 2.1.3
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-118663?
- CVE-2026-118663 is a medium-severity vulnerability in Honojs Node-Server, classified under CWE-174. CVSS score: 5.3/10. Published 2026-10-28.
- How severe is CVE-2026-118663?
- Medium severity. CVSS v3 base score is 5.3 out of 10.