Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
`serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it. Impact An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by `serveStatic`. Applications that serve only public files are not affected.
Recommended action: Upgrade to 2.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory. Details The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it. Impact An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded…
Recommended action: Upgrade to 2.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C). Summary On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked. Details The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/ does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree. This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware. Impact An unauthenticated attacker can read static files under a…
Recommended action: Upgrade to 2.0.5 or 1.19.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. Details The routing layer and serveStatic handle repeated slashes differently. For example: - /admin/secret.txt = matches /admin/ - //admin/secret.txt = may not match /admin/ This inconsistency allows a request such as: to bypass middleware registered on /admin/ and access protected files. Impact An attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path. This can lead to unauthorized access to sensitive files under the static root. This issue affects applications that rely on serveStatic together with route-based middleware for access…
Recommended action: Upgrade to 1.19.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. Details The routing layer and the node-server static handler normalize request paths differently. The router preserves %2F as a literal string when matching routes, while the static handler decodes %2F into / before resolving the filesystem path. Example request: - /admin%2Fsecret.html This may: - fail to match middleware intended for /admin/, but - still be resolved by the static handler as /admin/secret.html under the configured static root. This does not allow access outside the configured static root and is not a path…
Recommended action: Upgrade to 1.19.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The application hangs when receiving a Host header with a value that @hono/node-server can't handle well. Invalid values are those that cannot be parsed by the URL as a hostname such as an empty string, slashes /, and other strings. For example, if you have a simple application: Sending a request with a Host header with an empty value to it: The results: Patches The version 1.10.1 includes the fix for this issue. But, you should use 1.11.0, which has other fixes related to this issue. https://github.com/honojs/node-server/issues/160 https://github.com/honojs/node-server/issues/161 Workarounds Nothing. Upgrade your @hono/node-server. References https://github.com/honojs/node-server/issues/159
Recommended action: Upgrade to 1.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Since v1.3.0, we use our own Request object. This is great, but the url behavior is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path. However, the url in our Request does not resolve double dots, so http://localhost/static/.. /foo.txt is returned. It will pass unresolved paths to the web application. This causes vulnerabilities like #123 when using serveStatic. Note: Modern web browsers and a latest curl command resolve double dots on the client side, so it does not affect you if the user uses them. However, problems may occur if accessed by a client that does not resolve them. Patches "v1.4.1" includes the change to fix this issue. Workarounds Don't use serveStatic.
Recommended action: Upgrade to 1.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.