CWE-177

Improper Handling of URL Encoding (Hex Encoding)

4 CVEs Avg CVSS 6.8 MITRE
0
CRITICAL
3
HIGH
0
MEDIUM
1
LOW
0
POC
0
KEV

Monthly

CVE-2026-29045 HIGH PATCH This Week

Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.

Authentication Bypass Hono
NVD GitHub
CVSS 3.1
7.5
EPSS
0.0%
CVE-2026-22037 HIGH PATCH This Week

The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.

Node.js
NVD GitHub
CVSS 3.1
8.4
EPSS
0.1%
CVE-2026-22031 HIGH PATCH This Week

Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protected endpoints by using URL-encoded characters in requests, as the middleware engine fails to decode paths while the underlying router does. An attacker with valid credentials can exploit this inconsistency to circumvent middleware security controls and access restricted functionality. This vulnerability requires low privileges and network access, with no patch currently available.

Authentication Bypass
NVD GitHub VulDB
CVSS 3.1
8.4
EPSS
0.1%
CVE-2025-11990 LOW Monitor

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Gitlab CSRF
NVD
CVSS 3.1
3.1
EPSS
0.0%
CVE-2026-29045
EPSS 0% CVSS 7.5
HIGH PATCH This Week

Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.

Authentication Bypass Hono
NVD GitHub
CVE-2026-22037
EPSS 0% CVSS 8.4
HIGH PATCH This Week

The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.

Node.js
NVD GitHub
CVE-2026-22031
EPSS 0% CVSS 8.4
HIGH PATCH This Week

Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protected endpoints by using URL-encoded characters in requests, as the middleware engine fails to decode paths while the underlying router does. An attacker with valid credentials can exploit this inconsistency to circumvent middleware security controls and access restricted functionality. This vulnerability requires low privileges and network access, with no patch currently available.

Authentication Bypass
NVD GitHub VulDB
CVE-2025-11990
EPSS 0% CVSS 3.1
LOW Monitor

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Gitlab CSRF
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy