cve.bz

CWE-174: Double Decoding of the Same Data

Filter

The product decodes the same input twice.

What the weakness is: CWE-174 at MITRE

Ask an AI about CWE-174

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-174: Double Decoding of the Same Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/174.html and https://cve.bz/cve/cwe/174?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.1CVE-2026-119674

    MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection c…

  2. 5.3CVE-2026-118663EPSS 0.4%

    @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make ro…

  3. 5.9CVE-2026-118655EPSS 0.3%

    Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach…

  4. 5.3CVE-2026-111757EPSS 0.3%

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection …

  5. 6.9CVE-2026-109955EPSS 0.3%

    Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded path…

  6. 9.4CVE-2026-93903EPSS 0.3%

    LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

  7. 4.3CVE-2026-92839EPSS 0.3%

    Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.

  8. 7.5CVE-2026-75899EPSS 0.2%

    fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested perce…