CVE-2026-29087: Hono node-server authorization bypass via encoded slashes

CVE-2026-29087 · Severity: low · CVSS 3.1 · Published 2026-03-04

@hono/node-server is a Node.js server implementation for the Hono web framework, commonly used to serve static files and handle routing. An attacker can bypass route-based access controls protecting static resources by crafting URLs with encoded slashes (%2F), allowing unauthorized access to protected files without authentication or middleware enforcement.

Technologies: Hono Node-Server, @hono/node-server (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-29087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29087 being exploited in the wild.
How severe is CVE-2026-29087?
Low severity, with a CVSS score of 3.1, published 4 March 2026.
Which products and versions are affected?
Hono Node-Server < 1.19.10; @hono/node-server (npm) SEMVER:introduced=0,fixed=1.19.10.
Is there a fix for CVE-2026-29087?
Yes. @hono/node-server (npm): upgrade to 1.19.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29087 attacked?
It is attacked over the network.
Am I affected by CVE-2026-29087?
Check whether you run Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hono/node-server (npm): upgrade to 1.19.10 or later
    npm install @hono/node-server@1.19.10

Technical details

The vulnerability is an authorization bypass (CWE-863) caused by inconsistent URL decoding between the routing/middleware layer and the static file handler. The router preserves URL-encoded slashes (%2F) when matching routes, preventing middleware from running, while the static handler decodes %2F to / before resolving files on disk. This allows an attacker to request /admin%2Fsecret.html, which fails to match middleware rules for /admin/* but is decoded and served by the static handler as /admin/secret.html. The attack requires no authentication or user interaction and is network-accessible. The vulnerability does not enable path traversal outside the configured static root. A fix was released in version 1.19.10.

Affected products

  • Hono node-server < 1.19.10

Identifiers

  • CVE-2026-29087
  • GHSA-wc8c-qw6v-h7f6

Timeline

  • 2026-03-04: disclosed
  • 2026-03-04: patched: Fixed in version 1.19.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.