What is the CVSS score of CVE-2026-29087?

CVE-2026-29087 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-29087?

A critical authorization bypass vulnerability exists in @hono/node-server that could allow attackers to access protected administrative resources through URL encoding manipulation.. A patch is available.

How to fix or mitigate CVE-2026-29087?

Within 24 hours: Identify all applications using @hono/node-server and document their version numbers and deployment scope. Within 7 days: Implement compensating controls (WAF rules blocking %2F in static requests, disable static file serving if not critical, or add authentication bypass detection). Within 30 days: Monitor vendor releases for patch availability and establish expedited testing/deployment process; contact Hono maintainers for patch timeline.

Node.js CVE-2026-29087

HIGH

Incorrect Authorization (CWE-863)

2026-03-06 security-advisories@github.com

GHSA-wc8c-qw6v-h7f6

Authentication Bypass Node.js Hono Node Server

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 18:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on @hono/node-server (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.19.10.

DescriptionGitHub Advisory

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.

AnalysisAI

@hono/node-server versions prior to 1.19.10 contain an authorization bypass in static file serving due to inconsistent URL decoding between routing middleware and file resolution logic. An unauthenticated remote attacker can bypass route-based access controls by crafting requests with encoded slashes (%2F) to access protected static resources that should be restricted by middleware. Organizations running affected versions should upgrade immediately as no workaround is available.

Technical ContextAI

This vulnerability (CWE-863: Incorrect Authorization) affects hono/node-server allows running the Hono application on Node.js.. @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middl