100 matches found
CVE-2026-19264
CVE-2026-19264 - Unauthenticated Path Traversal to Full Instance Takeover in Postiz Author: Krithik Babu P @DarkLycn1976 Published: 2026-08-10 CVE: CVE-2026-19264 Severity: Critical - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory Affected:...
Security Bulletin: Vulnerability in InformixHQ
Summary Upgrade to InformixHQ 3.3.3 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normaliz...
CVE-2026-118663
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
GHSA-RMXM-3FG6-PX4F @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
Double Decoding of the Same Data
Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Double Decoding of the Same Data via the serveStatic middleware in src/serve-static.ts, where a percent-encoded path sequence in a request URL is decoded by tryDecodeURI before the path...
CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
EUVD-2026-112470
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118663
The @hono/node-server library (versions 1.19.10 through 2.1.3) is vulnerable to a middleware bypass due to double decoding of the request path. Specifically, the serveStatic function decodes the path a second time after Hono has already performed decoding for routing. An unauthenticated attacker ...
CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
PT-2026-129184
Name of the Vulnerable Software and Affected Versions @hono/node-server versions 1.19.10 through 2.1.2 Description The serveStatic function decodes the request path a second time after the application has already decoded it for routing. A malformed percent-encoded sequence can cause the route...
CVE-2026-118663: Double Decoding of the Same Data
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118655: Double Decoding of the Same Data
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
Security Bulletin: vulnerability in fast-uri URI parser for Node.js.
Summary Vulnerability in fast-uri URI parser for Node.js. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a...
Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub
Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.4.0 Patch 8 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...
GHSA-5R4P-P66F-JHC7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
EUVD-2026-104537
Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths...
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...