Executive brief
Hono node-server is a tool used to run Hono web applications on the Node.js platform. A security flaw in how it handles web addresses allows unauthorized users to bypass security checks and access private files by simply adding extra slashes to a URL. This could lead to the exposure of sensitive internal documents or configuration files that were intended to be restricted to administrators.
Technical details
A path normalization inconsistency exists between the Hono router and the serveStatic middleware in @hono/node-server. When authorization middleware is applied to a specific route pattern (e.g., /admin/*), the router may fail to match requests containing repeated slashes (like //admin/file.txt), effectively skipping the security check. However, the serveStatic component subsequently normalizes these paths, resolving them to the protected files and serving them to the unauthenticated requester. This vulnerability is classified as a path traversal/middleware bypass and is resolved in version 1.19.13.
Affected products
- Hono node-server < 1.19.13
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE-2026-39406 published