CVE-2026-29087: Hono Node Server Auth Bypass Vulnerability

CVE-2026-29087 Overview

CVE-2026-29087 is an authorization bypass vulnerability in @hono/node-server, a package that enables running Hono applications on Node.js. Prior to version 1.19.10, when using the static file serving feature together with route-based middleware protections (such as protecting /admin/* paths), inconsistent URL decoding allows protected static resources to be accessed without authorization.

Critical Impact

Attackers can bypass authentication and authorization middleware to access protected static files by exploiting URL encoding inconsistencies, potentially exposing sensitive administrative resources, configuration files, or other protected content.

Affected Products

• @hono/node-server versions prior to 1.19.10
• Hono applications using static file serving with route-based middleware protection
• Node.js deployments utilizing affected @hono/node-server versions

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-29087 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29087

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization) and represents an authorization bypass flaw caused by URL decoding inconsistency between middleware routing and static file resolution components.

The core issue arises when URL paths containing encoded characters, particularly encoded slashes (%2F), are processed differently by two separate components within @hono/node-server. The routing and middleware matching logic interprets the URL one way, while the static file path resolution interprets it differently. This discrepancy creates a security gap where authorization checks can be bypassed while still serving the requested static file.

For example, when a path like /admin/config.json is protected by middleware, an attacker might request /admin%2Fconfig.json or similar encoded variations. The middleware may not recognize this as matching the protected /admin/* route pattern, allowing the request to proceed without authorization checks. However, the static file serving component may decode the path and successfully serve the protected file.

Root Cause

The root cause stems from inconsistent URL normalization and decoding practices between the middleware routing layer and the static file serving layer. When the routing system evaluates whether a request matches a protected route pattern, it may use the raw (encoded) URL path. Meanwhile, the static file serving component decodes the URL path to resolve the actual file on the filesystem.

This architectural inconsistency violates the security principle that authorization decisions should be made on the same representation of data that is ultimately acted upon.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by crafting HTTP requests with URL-encoded characters in the path, specifically targeting protected routes that serve static files.

The attack flow involves sending requests with paths containing encoded slashes (%2F) or other URL-encoded characters to bypass middleware route matching while still resolving to protected static files. This allows unauthorized access to files that should be protected by authentication or authorization middleware.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-wc8c-qw6v-h7f6.

Detection Methods for CVE-2026-29087

Indicators of Compromise

• HTTP access logs showing requests with URL-encoded slashes (%2F) targeting protected directories
• Unusual access patterns to static files in administrative or protected paths
• Requests containing multiple levels of URL encoding (double encoding) in path segments
• Successful responses (HTTP 200) to encoded paths that should be protected

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with suspicious URL encoding patterns
• Enable detailed HTTP access logging and monitor for requests containing %2F or other encoded path separators
• Deploy SentinelOne Singularity to detect anomalous access patterns to protected resources
• Audit application logs for successful access to files in protected directories from unauthenticated sessions

Monitoring Recommendations

• Configure alerts for access attempts to sensitive paths using encoded characters
• Monitor for reconnaissance activities scanning for path traversal or encoding bypass opportunities
• Track changes in access patterns to administrative static resources
• Implement file integrity monitoring on protected static file directories

How to Mitigate CVE-2026-29087

Immediate Actions Required

• Upgrade @hono/node-server to version 1.19.10 or later immediately
• Audit access logs for potential exploitation attempts using encoded path characters
• Review all route-based middleware protections to ensure they cannot be bypassed
• Consider implementing additional authorization checks at the static file serving layer

Patch Information

The vulnerability has been patched in @hono/node-server version 1.19.10. The fix ensures consistent URL decoding between the middleware routing layer and static file resolution, preventing the bypass condition.

The patch is available in commit 455015be1697dd89974a68b70350ea7b2d126d2e. Organizations should update their dependencies by running npm update @hono/node-server or explicitly installing the patched version with npm install @hono/node-server@1.19.10.

Workarounds

• Normalize and decode URLs before middleware route matching to ensure consistent evaluation
• Implement authorization checks directly in the static file serving handler rather than relying solely on route-based middleware
• Use a reverse proxy that normalizes URL encoding before requests reach the application
• Temporarily disable static file serving for sensitive directories until the patch can be applied

# Update @hono/node-server to patched version
npm update @hono/node-server

# Or explicitly install the fixed version
npm install @hono/node-server@1.19.10

# Verify installed version
npm list @hono/node-server