CVE-2026-118663

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...

GHSA-RMXM-3FG6-PX4F @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663

The @hono/node-server library (versions 1.19.10 through 2.1.3) is vulnerable to a middleware bypass due to double decoding of the request path. Specifically, the serveStatic function decodes the path a second time after Hono has already performed decoding for routing. An unauthenticated attacker ...

EUVD-2026-112470

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

PT-2026-129184

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 1.19.10 through 2.1.2 Description The serveStatic function decodes the request path a second time after the application has already decoded it for routing. A malformed percent-encoded sequence can cause the route...

CVE-2026-118663: Double Decoding of the Same Data

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

Infinite loop

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can cause the Node server's event loop to become unresponsive by sending specially crafted JSON input with a member name that triggers...

Infinite loop

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. ...

WS-2026-0106

@hono/node-server 1.19.10 before 2.1.3: serveStatic decodes the already-decoded request path a second time, so a crafted percent-encoded path bypasses middleware bound to the static path. The 1.x line is not fixed. GHSA-rmxm-3fg6-px4f...

@1mcp/agent (>=0.39.0-beta.4, <=0.39.5), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +345 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.1.1)

@hono/node-server NPM version =2.0.0, =0.39.0-beta.4, =0.1.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.4.0, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.8, =0.0.1-alpha.0, =0.0.1-alpha.47, =0.0.1-alpha.1, =0.0.1-alpha.94 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0106...

Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering

Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-39406)

Summary There are vulnerabilities in node-server-1.19.11.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-39406. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-39406 DESCRIPTION: @hono/node-server allows running the Hono application on Node.js. Prio...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...