CVE-2026-118663

The @hono/node-server library (versions 1.19.10 through 2.1.3) is vulnerable to a middleware bypass due to double decoding of the request path. Specifically, the serveStatic function decodes the path a second time after Hono has already performed decoding for routing. An unauthenticated attacker ...