Все уязвимости

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Connection redirection via percent-encoded delimiter injection in connection string hosts

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

Hono: Arbitrary file access via serveStatic vulnerability

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Velociraptor Stored XSS in URL column types

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Fastify Middie Middleware Path Bypass

@fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

Improper Handling of URL Encoding (Hex Encoding) in GitLab

QTS, QuTS hero

Access rules for PingAccess may be circumvented with URL-encoded characters