Threats Tagged 'cwe-177'

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

HighVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2026-29045#cwe-177

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.

HighVulnerabilityGermanyUnited KingdomFrance+3#cve#cve-2026-22037#cwe-177

CVE-2026-22031 is a high-severity vulnerability in the @fastify/middie plugin prior to version 9. 1. 0 that allows bypassing middleware protections via URL-encoded path prefixes. The middleware fails to decode URL-encoded characters when matching paths, while Fastify's router correctly decodes them, enabling attackers to access protected routes without middleware enforcement. This can lead to unauthorized access, compromising confidentiality and integrity of applications using vulnerable versions. The vulnerability requires network access and low privileges but no user interaction. Although no known exploits are reported, the impact on affected systems is significant. Upgrading to version 9. 1. 0 or later mitigates the issue.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-22031#cwe-177