CWE-174 · weakness in Injection and Smuggling
Double Decoding of the Same Data
8 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.
- @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged ten…
- Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
- Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- Echo: Static Middleware Double-Unescape Path Traversal
- Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s…
- fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- mongorestore may restore encoded collection names into an unintended collection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.