@hono/node-server allows static file serving to be bypassed when a request URL contains encoded slashes (%2F). The routing and middleware matchers decode URLs inconsistently with the static file resolver, letting requests that should trigger protected middleware skip it and reach the file handler. This results in an authorization bypass, exposing any file placed under a protected path. The weakness is categorized as CWE-863, short‑circuit state control.

The vulnerability affects the Honojs node-server package. All releases prior to 1.19.10 may serve protected static resources without authentication. The fix is available in version 1.19.10.

The CVSS score of 7.5 indicates a high impact, but the EPSS score is less than 1% and the vulnerability is not listed in the KEV catalog, suggesting that exploitation is unlikely in the wild. Nevertheless, an attacker who can send HTTP requests to the target can construct a path such as "/admin%2Fsecret.txt" to retrieve static content intended to be protected. No additional privileges or elevated access are required, making the attack straightforward for anyone with network connectivity to the server.