CVE-2026-118650 is a vulnerability in the labstack Echo Go web framework affecting versions prior to 4.16.0 and 5.4.0. It involves improper handling of URL encoding in the globally mounted middleware.Static instance, where the static handler decodes the URL path differently than the router, leading to inconsistent route protection. This discrepancy can allow an encoded slash to resolve to files under the static root unexpectedly. The issue is fixed in versions 4.16.0 and 5.4.0.
## Summary
When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.
`enableCacheInterception` is disabled by default.
## Impact
A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.
An application is affected when it:
- explicitly enables `enableCacheInterception`;
- relies on middleware for access control; and
- has a matching cached route.
## Details
Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.
For example, consider an application with:
- middleware matcher `/admin/:path*`;
- middleware returning `401 Authentication required` for `/admin`;
- a statically generated, cached `/admin` route; and
- cache interception enabled:
```ts
export default defineCloudflareConfig({
incrementalCache: staticAssetsIncrementalCache,
enableCacheInterception: true,
});
```
An attacker can request:
```http
GET /%61dmin
```
The encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:
```http
HTTP/1.1 200 OK
x-opennext-cache: HIT
Protected content
```
Malformed paths exposed an additional inconsistency. For example:
```http
GET /%61dmin/%ZZ
```
The previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.
## Patches
The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).
Users should upgrade to `@opennextjs/cloudflare@1.20.2` or later.
## Workarounds
If upgrading is not immediately possible for an application:
1. Disable cache interception by removing `enableCacheInterception: true`.
2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.
3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.
Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.
CVE-2026-96748 is a vulnerability in the PyMongo Python driver for MongoDB where improper handling of URL encoding in connection strings can allow an attacker to inject additional servers into the client's host list. This occurs because percent-encoded characters in the host portion are decoded before splitting the host list, enabling an unauthenticated party to manipulate the connection string. As a result, the application may send authentication and database operations to attacker-controlled servers, which can observe limited information and return altered results. The issue affects PyMongo versions from 0 up to but not including 4.18.2.
CVE-2026-67448 is a vulnerability in axllent mailpit versions 1.29.0 through 1.30.5 involving improper handling of URL encoding in WebSocket origin checks. The origin check relies on the raw request URI prefix, but Go's ServeMux routes on the percent-decoded path, allowing an attacker to bypass origin validation by encoding the path. This leads to unauthorized WebSocket connections that can leak sensitive email data. The issue arises because the upgrader accepts all origins and the middleware origin check is bypassed due to inconsistent handling of encoded URLs.
CVE-2026-15371 is a high-severity vulnerability in Rapid7 Velociraptor versions from 0 up to but not including 0.77.2. The web GUI allows users to specify a custom column type as a URL, but it does not restrict URL schemes. This flaw permits an attacker to use a JavaScript scheme, leading to a cross-site scripting (XSS) risk when users click the crafted URL in the GUI.
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g.app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.
CVE-2026-22031 is a high-severity vulnerability in the @fastify/middie plugin prior to version 9.1.0 that allows bypassing middleware protections via URL-encoded path prefixes. The middleware fails to decode URL-encoded characters when matching paths, while Fastify's router correctly decodes them, enabling attackers to access protected routes without middleware enforcement. This can lead to unauthorized access, compromising confidentiality and integrity of applications using vulnerable versions. The vulnerability requires network access and low privileges but no user interaction. Although no known exploits are reported, the impact on affected systems is significant. Upgrading to version 9.1.0 or later mitigates the issue.