CVE-2026-39406: Hono node-server middleware bypass in serveStatic

CVE-2026-39406 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Hono node-server is a tool used to run Hono web applications on the Node.js platform. A security flaw in how it handles web addresses allows unauthorized users to bypass security checks and access private files by simply adding extra slashes to a URL. This could lead to the exposure of sensitive internal documents or configuration files that were intended to be restricted to administrators.

Technologies: Hono Node-Server, @hono/node-server (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-39406 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39406 being exploited in the wild.
How severe is CVE-2026-39406?
Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?
Hono Node-Server < 1.19.13; @hono/node-server (npm) SEMVER:introduced=0,fixed=1.19.13.
Is there a fix for CVE-2026-39406?
Yes. @hono/node-server (npm): upgrade to 1.19.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39406 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39406?
Check whether you run Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hono/node-server (npm): upgrade to 1.19.13 or later
    npm install @hono/node-server@1.19.13

Technical details

A path normalization inconsistency exists between the Hono router and the serveStatic middleware in @hono/node-server. When authorization middleware is applied to a specific route pattern (e.g., /admin/*), the router may fail to match requests containing repeated slashes (like //admin/file.txt), effectively skipping the security check. However, the serveStatic component subsequently normalizes these paths, resolving them to the protected files and serving them to the unauthenticated requester. This vulnerability is classified as a path traversal/middleware bypass and is resolved in version 1.19.13.

Affected products

  • Hono node-server < 1.19.13

Identifiers

  • CVE-2026-39406
  • GHSA-92pp-h63x-v22m

Timeline

  • 2026-04-07: advisory: GitHub Security Advisory published
  • 2026-04-08: disclosed: CVE-2026-39406 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.