7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29087

CVE-2026-29087: @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29087

CVE-2026-29087:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hono/node-server	npm	< 1.19.10	1.19.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @hono/node-server package and is an authorization bypass in the serveStatic middleware. The root cause is an inconsistency in URL path handling between Hono's router and the serveStatic function. The router does not decode URL-encoded characters like %2F (slash) before matching routes, while the serveStatic function, prior to the patch, used decodeURIComponent, which does. This allowed an attacker to craft a URL that would bypass route-based authorization checks but still be correctly interpreted by the file-serving logic. The provided commit patch confirms this analysis. It replaces the vulnerable decodeURIComponent(c.req.path) with a new tryDecodeURI(c.req.path) function. The new implementation uses decodeURI, which, unlike decodeURIComponent, does not decode reserved characters such as /. This change ensures that a path with an encoded slash is treated consistently by both the router and the static file server, preventing the bypass. The vulnerable function is therefore serveStatic as it contained the logic that improperly processed the user-controlled request path.

Vulnerable functions

serveStatic

src/serve-static.ts

The `serveStatic` function was vulnerable because it used `decodeURIComponent` to process the request path. This function decodes URL-encoded characters, including slashes (`%2F`). This behavior was inconsistent with Hono's router, which does not decode the path before matching routes. An attacker could exploit this discrepancy by sending a request with an encoded slash (e.g., `/admin%2Fsecret.txt`). The router would not match a protected route like `/admin/*`, thus bypassing any authorization middleware. However, the `serveStatic` handler would decode `%2F` to `/`, resolve the path to `/admin/secret.txt`, and serve the protected file, leading to an authorization bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.