Node Server
Monthly
@hono/node-server versions prior to 1.19.10 contain an authorization bypass in static file serving due to inconsistent URL decoding between routing middleware and file resolution logic. An unauthenticated remote attacker can bypass route-based access controls by crafting requests with encoded slashes (%2F) to access protected static resources that should be restricted by middleware. Organizations running affected versions should upgrade immediately as no workaround is available.
In @hono/node-server 1.19.10 through 2.1.2, the serveStatic middleware decodes the request path a second time after Hono has already decoded it for routing, letting remote unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) fetch files under a static prefix whose route middleware - typically an authentication check - never runs, yielding low confidentiality impact confined to the configured static root. Only deployments that mount middleware on a sub-portion of the directory served by serveStatic (for example auth on /static/admin/* while serveStatic covers /static/*) are exposed; applications serving purely public files are unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor-released patch is version 2.1.3, which by default skips routed paths that still contain '%' unless allowPercentInPath:true is explicitly set.
Unbounded memory growth in @hono/node-server 2.0.0-2.0.9 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by flooding any public WebSocket upgrade route with requests bearing a missing or malformed Sec-WebSocket-Key header. The root cause is a missing cleanup path in src/websocket.ts: when ws.handleUpgrade rejects the handshake, no connection event fires, leaving the IncomingMessage permanently retained in waiterMap and the waitForWebSocket promise perpetually pending. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in v2.0.10.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
@hono/node-server versions prior to 1.19.10 contain an authorization bypass in static file serving due to inconsistent URL decoding between routing middleware and file resolution logic. An unauthenticated remote attacker can bypass route-based access controls by crafting requests with encoded slashes (%2F) to access protected static resources that should be restricted by middleware. Organizations running affected versions should upgrade immediately as no workaround is available.
In @hono/node-server 1.19.10 through 2.1.2, the serveStatic middleware decodes the request path a second time after Hono has already decoded it for routing, letting remote unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) fetch files under a static prefix whose route middleware - typically an authentication check - never runs, yielding low confidentiality impact confined to the configured static root. Only deployments that mount middleware on a sub-portion of the directory served by serveStatic (for example auth on /static/admin/* while serveStatic covers /static/*) are exposed; applications serving purely public files are unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor-released patch is version 2.1.3, which by default skips routed paths that still contain '%' unless allowPercentInPath:true is explicitly set.
Unbounded memory growth in @hono/node-server 2.0.0-2.0.9 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by flooding any public WebSocket upgrade route with requests bearing a missing or malformed Sec-WebSocket-Key header. The root cause is a missing cleanup path in src/websocket.ts: when ws.handleUpgrade rejects the handshake, no connection event fires, leaving the IncomingMessage permanently retained in waiterMap and the waitForWebSocket promise perpetually pending. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in v2.0.10.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.