Is CVE-2026-118663 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118663 being exploited in the wild.

How severe is CVE-2026-118663?

Medium severity, with a CVSS score of 5.3, published 28 October 2026.

Which products and versions are affected?

@hono/node-server (npm) >= 1.19.10, < 2.1.3, SEMVER:introduced=1.19.10,fixed=2.1.3.

How is CVE-2026-118663 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118663?

Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118663: @hono/node-server serveStatic path decoding bypass

Q: Is there a fix for CVE-2026-118663?

Yes. @hono/node-server (npm): upgrade to 2.1.3 or later. Until then: By default, serveStatic now rejects request paths containing % after decoding. If you serve files with literal percent signs in their names, set the allowPercentInPath option to true, but be aware this re-enables the vulnerability. For restricted static paths, apply access control middleware to the full static prefix (e.g., /static/*) rather than subpaths (e.g., /static/admin/*). [{"vendor":"Hono", "product":"node-server", "category":"library", "versions":"1.19.10 to 2.1.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-118663 · Severity: medium · CVSS 5.3 · Published 2026-10-28

@hono/node-server is a Node.js server for running Hono web applications. The serveStatic middleware function decodes file paths twice, allowing attackers to craft requests that bypass route-level access controls and read files that should be protected, though files outside the configured directory remain inaccessible.

Technologies: @hono/node-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-118663 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118663 being exploited in the wild.
How severe is CVE-2026-118663?: Medium severity, with a CVSS score of 5.3, published 28 October 2026.
Which products and versions are affected?: @hono/node-server (npm) >= 1.19.10, < 2.1.3, SEMVER:introduced=1.19.10,fixed=2.1.3.
Is there a fix for CVE-2026-118663?: Yes. @hono/node-server (npm): upgrade to 2.1.3 or later. Until then: By default, serveStatic now rejects request paths containing % after decoding. If you serve files with literal percent signs in their names, set the allowPercentInPath option to true, but be aware this re-enables the vulnerability. For restricted static paths, apply access control middleware to the full static prefix (e.g., /static/*) rather than subpaths (e.g., /static/admin/*).</anigation> <parameter name="affected_products">[{"vendor":"Hono", "product":"node-server", "category":"library", "versions":"1.19.10 to 2.1.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118663 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118663?: Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hono/node-server (npm): upgrade to 2.1.3 or later
```
npm install @hono/node-server@2.1.3
```

By default, serveStatic now rejects request paths containing % after decoding. If you serve files with literal percent signs in their names, set the allowPercentInPath option to true, but be aware this re-enables the vulnerability. For restricted static paths, apply access control middleware to the full static prefix (e.g., /static/*) rather than subpaths (e.g., /static/admin/*).</anigation> <parameter name="affected_products">[{"vendor":"Hono", "product":"node-server", "category":"library", "versions":"1.19.10 to 2.1.2"}]

Technical details

The serveStatic middleware decodes request paths a second time after Hono's routing layer has already decoded them, creating a discrepancy: route middleware evaluates the first-decoded path while file resolution uses the second-decoded path. An attacker can send malformed percent-encoded sequences to route through one path and be served from another, bypassing middleware restrictions on static prefixes. The vulnerability is limited to files within the configured static root; directory traversal outside that root is not possible.

Affected products

@hono/node-server (npm) >= 1.19.10, < 2.1.3, SEMVER:introduced=1.19.10,fixed=2.1.3

Identifiers

CVE-2026-118663
GHSA-rmxm-3fg6-px4f

Timeline

2026-10-28: disclosed
2026-09-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.