# CVE-2026-29087: Hono node-server authorization bypass via encoded slashes

Source: https://junglewise.ai/threats/cve-2026-29087-hono-node-server-authorization-bypass-via-encoded-slashes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-29087 · Severity: low · CVSS 3.1 · Published 2026-03-04

@hono/node-server is a Node.js server implementation for the Hono web framework, commonly used to serve static files and handle routing. An attacker can bypass route-based access controls protecting static resources by crafting URLs with encoded slashes (%2F), allowing unauthorized access to protected files without authentication or middleware enforcement.

Technologies: [Hono Node-Server](https://junglewise.ai/threats/technologies/node-server), [@hono/node-server (npm)](https://junglewise.ai/threats/technologies/hono-node-server). Vendors: [Hono](https://junglewise.ai/threats/vendors/hono), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-29087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29087 being exploited in the wild.

**How severe is CVE-2026-29087?** Low severity, with a CVSS score of 3.1, published 4 March 2026.

**Which products and versions are affected?** Hono Node-Server < 1.19.10; @hono/node-server (npm) SEMVER:introduced=0,fixed=1.19.10.

**Is there a fix for CVE-2026-29087?** Yes. @hono/node-server (npm): upgrade to 1.19.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29087 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-29087?** Check whether you run Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hono/node-server (npm): upgrade to 1.19.10 or later

  ```sh
  npm install @hono/node-server@1.19.10
  ```


## Technical details

The vulnerability is an authorization bypass (CWE-863) caused by inconsistent URL decoding between the routing/middleware layer and the static file handler. The router preserves URL-encoded slashes (%2F) when matching routes, preventing middleware from running, while the static handler decodes %2F to / before resolving files on disk. This allows an attacker to request /admin%2Fsecret.html, which fails to match middleware rules for /admin/* but is decoded and served by the static handler as /admin/secret.html. The attack requires no authentication or user interaction and is network-accessible. The vulnerability does not enable path traversal outside the configured static root. A fix was released in version 1.19.10.

## Affected products

- Hono node-server < 1.19.10

## Identifiers

- CVE-2026-29087
- GHSA-wc8c-qw6v-h7f6

## Timeline

- 2026-03-04: disclosed
- 2026-03-04: patched: Fixed in version 1.19.10

## References

- [https://github.com/honojs/node-server/security/advisories/GHSA-wc8c-qw6v-h7f6](https://github.com/honojs/node-server/security/advisories/GHSA-wc8c-qw6v-h7f6)

## Related threats

- [@hono/node-server WebSocket ECONNRESET denial of service](https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an)
- [@hono/node-server path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a)
- [@hono/node-server serveStatic path decoding bypass](https://junglewise.ai/threats/cve-2026-118663-hono-node-server-allows-running-the-hono-application-on-node-js)
- [Hono Node.js Adapter WebSocket memory leak DoS](https://junglewise.ai/threats/cve-2026-73565-hono-node-js-adapter-websocket-memory-leak-dos)
- [Hono Node.js Adapter path traversal in serve-static on Windows](https://junglewise.ai/threats/hono-node-js-adapter-path-traversal-in-serve-static-on-windows-4c8754f6)