CVE-2026-54286

Name of the Vulnerable Software and Affected Versions serve-static (affected versions not specified)

Description On Windows hosts, an encoded backslash (%5C) in the request path decodes to , which the Windows path resolver treats as a separator. Because the router splits paths only on `/`, a request such as `/admin%5Csecret.txt` is treated as a single segment, bypassing middleware mounted on prefixes like `/admin/*`. The `serve-static` guard allows a lone to pass, enabling the file resolver to treat it as a nested file under the root. This allows an unauthenticated attacker to read static files intended to be protected by prefix-mounted middleware, although access remains restricted to the configured root directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.