# CVE-2026-118663: @hono/node-server serveStatic path decoding bypass

Source: https://junglewise.ai/threats/cve-2026-118663-hono-node-server-allows-running-the-hono-application-on-node-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118663 · Severity: medium · CVSS 5.3 · Published 2026-10-28

@hono/node-server is a Node.js server for running Hono web applications. The serveStatic middleware function decodes file paths twice, allowing attackers to craft requests that bypass route-level access controls and read files that should be protected, though files outside the configured directory remain inaccessible.

Technologies: [@hono/node-server (npm)](https://junglewise.ai/threats/technologies/hono-node-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118663 being exploited in the wild.

**How severe is CVE-2026-118663?** Medium severity, with a CVSS score of 5.3, published 28 October 2026.

**Which products and versions are affected?** @hono/node-server (npm) >= 1.19.10, < 2.1.3, SEMVER:introduced=1.19.10,fixed=2.1.3.

**Is there a fix for CVE-2026-118663?** Yes. @hono/node-server (npm): upgrade to 2.1.3 or later. Until then: By default, serveStatic now rejects request paths containing % after decoding. If you serve files with literal percent signs in their names, set the allowPercentInPath option to true, but be aware this re-enables the vulnerability. For restricted static paths, apply access control middleware to the full static prefix (e.g., /static/*) rather than subpaths (e.g., /static/admin/*).</anigation>
<parameter name="affected_products">[{"vendor":"Hono", "product":"node-server", "category":"library", "versions":"1.19.10 to 2.1.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118663 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118663?** Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hono/node-server (npm): upgrade to 2.1.3 or later

  ```sh
  npm install @hono/node-server@2.1.3
  ```


By default, serveStatic now rejects request paths containing % after decoding. If you serve files with literal percent signs in their names, set the allowPercentInPath option to true, but be aware this re-enables the vulnerability. For restricted static paths, apply access control middleware to the full static prefix (e.g., /static/*) rather than subpaths (e.g., /static/admin/*).</anigation>
<parameter name="affected_products">[{"vendor":"Hono", "product":"node-server", "category":"library", "versions":"1.19.10 to 2.1.2"}]

## Technical details

The serveStatic middleware decodes request paths a second time after Hono's routing layer has already decoded them, creating a discrepancy: route middleware evaluates the first-decoded path while file resolution uses the second-decoded path. An attacker can send malformed percent-encoded sequences to route through one path and be served from another, bypassing middleware restrictions on static prefixes. The vulnerability is limited to files within the configured static root; directory traversal outside that root is not possible.

## Affected products

- @hono/node-server (npm) >= 1.19.10, < 2.1.3, SEMVER:introduced=1.19.10,fixed=2.1.3

## Identifiers

- CVE-2026-118663
- GHSA-rmxm-3fg6-px4f

## Timeline

- 2026-10-28: disclosed
- 2026-09-29: patched

## References

- [https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f](https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f)
- [https://github.com/honojs/node-server/releases/tag/v2.1.3](https://github.com/honojs/node-server/releases/tag/v2.1.3)

## Related threats

- [@hono/node-server WebSocket ECONNRESET denial of service](https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an)
- [@hono/node-server path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a)
- [Hono Node.js Adapter WebSocket memory leak DoS](https://junglewise.ai/threats/cve-2026-73565-hono-node-js-adapter-websocket-memory-leak-dos)
- [Hono Node.js Adapter path traversal in serve-static on Windows](https://junglewise.ai/threats/hono-node-js-adapter-path-traversal-in-serve-static-on-windows-4c8754f6)
- [Hono node-server middleware bypass in serveStatic](https://junglewise.ai/threats/cve-2026-39406-hono-node-server-middleware-bypass-in-servestatic)