CVE-2026-118663
Description
A flaw was found in node-server. This flaw allows an unauthenticated remote attacker to bypass route middleware, such as authentication checks, and access protected static files within the configured root directory. The vulnerability occurs because the static file serving function decodes request paths a second time after initial routing, causing specially crafted percent-encoded paths to bypass prefix-based security controls.
Statement
This vulnerability is rated as Moderate because, while an unauthenticated remote user can bypass prefix-based middleware such as access controls, data exposure is strictly confined to files within the designated static root directory. The flaw does not permit arbitrary directory traversal beyond that root, nor does it affect system integrity or availability. Environments serving only publicly accessible static assets or those enforcing authentication at the reverse proxy level are not exposed to unauthorized disclosure.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
