CWE-174 · Injection and Smuggling
Double Decoding of the Same Data
8CVEs
SortMost likely exploited
8 CVEs with CWE-174 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs · node-server · CVSS 5.3 · 2026-10-28 | 5.3 | 0.4% | 2026-10-28 |
| CVE-2026-93903LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged ten…litespeedtech · LiteSpeed Web Server · CVSS 9.4 · 2026-09-30 | 9.4 | 0.4% | 2026-09-30 |
| CVE-2026-109955Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decodinghonojs · hono · CVSS 5.3 · 2026-10-13 | 5.3 | 0.3% | 2026-10-13 |
| CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs · hono · CVSS 5.3 · 2026-10-19 | 5.3 | 0.3% | 2026-10-19 |
| CVE-2026-118655Echo: Static Middleware Double-Unescape Path Traversallabstack · echo · CVSS 5.9 · 2026-10-28 | 5.9 | 0.3% | 2026-10-28 |
| CVE-2026-92839Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s…Canva · Canva · CVSS 4.3 · 2026-09-17 | 4.3 | 0.3% | 2026-09-17 |
| CVE-2026-75899fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingfast-uri · fast-uri · CVSS 7.5 · 2026-08-24 | 7.5 | 0.2% | 2026-08-24 |
| CVE-2026-119674mongorestore may restore encoded collection names into an unintended collectionMongoDB · Database Tools · CVSS 3.7 · 2026-11-03 | 3.7 | 0.2% | 2026-11-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.