CVE-2026-118663: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

October 28, 2026

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

References

github.com/advisories/GHSA-rmxm-3fg6-px4f
github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f
github.com/honojs/node-server/releases/tag/v2.1.3
github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f
nvd.nist.gov/vuln/detail/CVE-2026-118663

Code Behaviors & Features

Detect and mitigate CVE-2026-118663 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →