CVE-2026-29087: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29087 is an authorization bypass vulnerability in the @hono/node-server npm package, specifically in its Serve Static Middleware. When static file serving is combined with route-based middleware protections (e.g., guarding /admin/*), inconsistent URL decoding allows protected static resources to be accessed without authorization by supplying paths with encoded slashes (%2F). All versions prior to 1.19.10 are affected. The vulnerability was published on March 3, 2026, and has a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). IBM products including DevOps Solution Workbench, API Connect, Db2 Warehouse on Cloud Pak for Data, and watsonx Orchestrate are also affected as downstream consumers (IBM DevOps Advisory).

The root cause is an inconsistent URL decoding behavior between the routing/middleware layer and the static file handler (CWE-863: Incorrect Authorization). The router preserves %2F as a literal string when matching routes, while the static handler calls decodeURIComponent() on the request path before resolving the filesystem path — meaning a request to /admin%2Fsecret.html fails to match the /admin/* middleware pattern but is still resolved to /admin/secret.html on disk. The fix in commit 455015b replaces decodeURIComponent with a safer tryDecodeURI function that uses decodeURI (which does not decode %2F) and applies consistent normalization, ensuring that encoded-slash paths return a 404 rather than serving the protected file (GitHub Commit, GitHub Advisory). This is not a path traversal vulnerability and does not allow access outside the configured static root.

Successful exploitation allows an unauthenticated remote attacker to read confidential static files that are intended to be protected by route-based middleware (e.g., files under /admin/). The impact is limited to confidentiality — integrity and availability are not affected. Applications that rely solely on Hono route-based middleware to gate access to sensitive static assets (such as configuration files, admin pages, or private documents) are at risk of unauthorized data disclosure (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker against a vulnerable deployment. The EPSS score is approximately 0.032% (low probability of exploitation in the next 30 days). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify web applications built with @hono/node-server versions prior to 1.19.10 that serve static files and use route-based middleware to protect specific subdirectories (e.g., /admin/*).
2. Identify protected paths: Browse or enumerate the application to discover static resource paths that are restricted by middleware (e.g., /admin/secret.txt, /admin/config.json).
3. Craft encoded request: Replace the literal slash (/) separating the protected directory from the filename with its percent-encoded equivalent (%2F). For example, transform /admin/secret.txt into /admin%2Fsecret.txt.
4. Send the request: Issue an HTTP GET request to the encoded path (e.g., GET /static/admin%2Fsecret.txt HTTP/1.1). The router fails to match the /admin/* middleware pattern (because %2F is not decoded at routing time), so the authorization middleware does not execute.
5. Receive protected file: The static handler decodes %2F to / and resolves the filesystem path to the protected file, returning its contents in the HTTP response without any authorization check (GitHub Advisory, GitHub Commit).

• Network: HTTP GET requests to static file paths containing %2F in place of / within a protected directory segment (e.g., GET /static/admin%2Fsecret.txt); requests that return 200 OK for paths that should be restricted.
• Logs: Web server or application access logs showing requests with percent-encoded slashes (%2F) in URL paths targeting protected subdirectories, particularly without corresponding authorization middleware headers being set (e.g., absence of expected X-Authorized or session headers in responses).
• Anomaly: Successful responses (HTTP 200) to requests for files under protected paths (e.g., /admin/) where the URL contains %2F instead of /, especially from unauthenticated or unexpected source IPs.

Upgrade @hono/node-server to version 1.19.10 or later, which resolves the inconsistent URL decoding by replacing decodeURIComponent with decodeURI in the static handler, ensuring %2F is not decoded during path resolution (GitHub Advisory, GitHub Commit). As a temporary workaround, avoid relying solely on route-based middleware to protect static assets; instead, implement authorization checks within the static serving logic itself or move sensitive files outside the static root. IBM product users should apply the relevant security bulletins for DevOps Solution Workbench, API Connect, Db2 Warehouse on Cloud Pak for Data, and watsonx Orchestrate (IBM DevOps Advisory, IBM API Connect).

The vulnerability was published by yusukebe (a core Hono maintainer) via a GitHub Security Advisory on March 3, 2026, with a patch released simultaneously (GitHub Advisory). Social media activity was limited, with brief mentions on Bluesky and Mastodon shortly after disclosure. IBM issued multiple security bulletins acknowledging the impact on several enterprise products, indicating broader downstream awareness (IBM DevOps Advisory).