Is CVE-2026-29087 actively exploited?

No active exploitation of CVE-2026-29087 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-29087 be exploited remotely?

Yes. CVE-2026-29087 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-29087?

CVE-2026-29087 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-29087

HIGH

CVE-2026-29087

CWE-863Published: March 6, 2026· Updated: Mar 9, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.8th

Official Description

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.

NVD Source

Technical Analysis

CVE-2026-29087 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.