CWE-177 Improper Handling of URL Encoding (Hex Encoding)
Description
The product does not properly handle when all or part of an input has been URL encoded.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-177 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-2vc4-c4r6-p6v6 | CVE-2026-100409 | HIGH |
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths |
2026-10-15 | |
| GHSA-vp6j-j7w5-5xjj | CVE-2026-96748 | HIGH |
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters |
2026-10-05 | |
| GHSA-8r62-w5wh-fc5m | CVE-2026-67448 | MODERATE |
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) |
2026-09-02 | |
| GHSA-jqff-g426-hqxp | CVE-2026-76172 | HIGH |
fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
2026-09-02 | |
| GHSA-x428-ghpx-8j92 | CVE-2026-6414 | MODERATE |
@fastify/static vulnerable to route guard bypass via encoded path separators |
2026-04-16 | |
| GHSA-q5qw-h33p-qvwr | CVE-2026-29045 | HIGH |
Hono vulnerable to arbitrary file access via serveStatic vulnerability |
2026-03-05 | |
| GHSA-c399-q49h-qwc8 | CVE-2025-29847 | HIGH |
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass |
2026-01-21 | |
| GHSA-g6q3-96cp-5r5m | CVE-2026-22037 | HIGH |
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) |
2026-01-20 | |
| GHSA-cxrg-g7r8-w69p | CVE-2026-22031 | HIGH |
Fastify Middie Middleware Path Bypass |
2026-01-20 | |
| GHSA-fvhj-4qfh-q2hm | CVE-2023-47106 | MODERATE |
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass |
2023-12-07 | |
| GHSA-5rc4-8qqh-vq7f | CVE-2018-3718 | MODERATE |
vercel/serve allows access to restricted files if filename is URL encoded. |
2023-09-12 | |
| GHSA-g8q8-fggx-9r3q | CVE-2022-3782 | CRITICAL |
Keycloak vulnerable to path traversal via double URL encoding |
2023-01-25 | |
| GHSA-wm77-q74p-5763 | - | HIGH |
Path Traversal in superstatic |
2021-08-09 |