CVE-2026-118663

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 1.19.10 through 2.1.2

Description The serveStatic function decodes the request path a second time after the application has already decoded it for routing. A malformed percent-encoded sequence can cause the route middleware to evaluate an encoded path while the static file resolution uses a different directory. This allows an unauthenticated attacker to bypass middleware mounted on a protected static prefix and read files within the configured static root. This issue does not permit directory traversal outside the configured root and only affects applications that mount middleware on parts of the directory served by serveStatic.

Recommendations Update @hono/node-server to version 2.1.3.