CWE-177
Improper Handling of URL Encoding (Hex Encoding)
Description
The product does not properly handle when all or part of an input has been URL encoded.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-120 · CAPEC-468 · CAPEC-64 · CAPEC-72
CVEs mapped to this weakness (9)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-22037 | Hig | 0.48 | 8.4 | 0.00 | Jan 19, 2026 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of… | ||
| CVE-2026-22031 | Hig | 0.48 | 8.4 | 0.00 | Jan 19, 2026 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin`… | ||
| CVE-2024-23983 | Med | 0.38 | — | 0.00 | Nov 11, 2024 | Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. | ||
| CVE-2018-3718 | Med | 0.35 | 5.3 | 0.01 | Jun 7, 2018 | serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded. | ||
| CVE-2026-6414 | Med | 0.31 | 5.9 | 0.00 | Apr 16, 2026 | @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served… | ||
| CVE-2026-29045 | 0.00 | — | 0.00 | Mar 4, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to… | |||
| CVE-2025-29847 | 0.00 | — | 0.01 | Jan 19, 2026 | A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks.… | |||
| CVE-2023-47106 | 0.00 | — | 0.01 | Dec 4, 2023 | Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain… | |||
| CVE-2022-3782 | 0.00 | — | 0.06 | Jan 11, 2023 | keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive… |
- risk 0.48cvss 8.4epss 0.00
The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of…
- risk 0.48cvss 8.4epss 0.00
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin`…
- risk 0.38cvss —epss 0.00
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
- risk 0.35cvss 5.3epss 0.01
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
- risk 0.31cvss 5.9epss 0.00
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served…
- CVE-2026-29045Mar 4, 2026risk 0.00cvss —epss 0.00
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to…
- CVE-2025-29847Jan 19, 2026risk 0.00cvss —epss 0.01
A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks.…
- CVE-2023-47106Dec 4, 2023risk 0.00cvss —epss 0.01
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain…
- CVE-2022-3782Jan 11, 2023risk 0.00cvss —epss 0.06
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive…