@hono/node-server EUVD-2026-112470

Exploitation requires an application that uses @hono/node-server's serveStatic (versions >= 1.19.10 and < 2.1.3) AND mounts route middleware - such as an authentication check - on only a sub-portion of the directory served by serveStatic (e.g. authMiddleware on /static/admin/* while serveStatic covers /static/*). The attacker sends a path containing a malformed percent-encoded sequence so Hono's single pre-routing decode leaves part of the path encoded (router matches the encoded form and skips the sub-prefix middleware) while serveStatic's second decode resolves the real file. Limiting factors: the target file must already reside inside the configured static root (no traversal outside it, so confidentiality impact is confined to files already served statically); applications that serve only public files, or that apply access control on the same route pattern as serveStatic, are not affected; and in the fixed version the default behavior rejects routed paths still containing '%' unless allowPercentInPath:true is explicitly set.

This is a genuine but bounded issue, best characterized as medium-real-risk rather than a high-urgency emergency. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, no privileges or user interaction, but confidentiality-only and Low. No EPSS probability was supplied in the input and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation. The supplied references are the GHSA advisory, the fix commit, and the 2.1.3 release - i.e. vendor-confirmed disclosure and patch, not a standalone weaponized exploit; the fix commit does include regression tests that demonstrate the exact bypass payload format (e.g. /static/%61dmin/secret.txt and /static/%%36%31dmin/secret.txt), so the triggering technique is public even though no independent working exploit was provided. The vuln.today priority is this_month, consistent with a real-but-not-critical fix. The most important nuance the raw CVSS hides: impact only materializes in a specific deployment pattern (middleware, such as an auth check, mounted on a sub-prefix of the directory served by serveStatic); applications serving only public files are unaffected, and no traversal outside the static root is possible. Treat PR:N as accurate for the request itself, but note the real-world blast radius is gated by configuration rather than by the base metrics.

An application mounts serveStatic on /static/* and separately mounts an authentication middleware on a protected subtree such as /static/admin/*. An unauthenticated attacker requests the protected file using a malformed percent-encoded sequence (for example /static/%61dmin/secret.txt or /static/%%36%31dmin/secret.txt) so the router matches the still-encoded path and the auth middleware never runs, while serveStatic's second decode resolves and returns the real protected file from inside the static root. The fix commit's regression tests publicly demonstrate this payload shape, though no separate working exploit was provided in the input.