Executive brief
@hono/node-server is a Node.js server implementation for the Hono web framework, commonly used to serve static files and handle routing. An attacker can bypass route-based access controls protecting static resources by crafting URLs with encoded slashes (%2F), allowing unauthorized access to protected files without authentication or middleware enforcement.
Technical details
The vulnerability is an authorization bypass (CWE-863) caused by inconsistent URL decoding between the routing/middleware layer and the static file handler. The router preserves URL-encoded slashes (%2F) when matching routes, preventing middleware from running, while the static handler decodes %2F to / before resolving files on disk. This allows an attacker to request /admin%2Fsecret.html, which fails to match middleware rules for /admin/* but is decoded and served by the static handler as /admin/secret.html. The attack requires no authentication or user interaction and is network-accessible. The vulnerability does not enable path traversal outside the configured static root. A fix was released in version 1.19.10.
Affected products
- Hono node-server < 1.19.10
Timeline
- 2026-03-04: disclosed
- 2026-03-04: patched: Fixed in version 1.19.10