Executive brief
Hono's Node.js Adapter serves static files via a web application framework. On Windows servers, an attacker can exploit how the framework processes URL-encoded backslashes to bypass security middleware and read protected static files—such as configuration or data files meant to be inaccessible. The vulnerability only affects Windows hosts and requires the static file serving to be guarded by prefix-based middleware.
Technical details
The vulnerability is a path traversal (CWE-22) affecting the serve-static middleware in Hono's Node.js Adapter versions 2.0.0–2.0.4 and all versions before 1.19.15. The root cause is inconsistent path handling between the router and file resolver on Windows: the router splits paths only on forward slashes (/), so a request to /admin%5Csecret.txt is treated as a single segment and bypasses middleware guarding /admin/*. However, the Windows file system resolver interprets %5C (encoded backslash) as a path separator, re-splitting the path and resolving the file into the protected directory tree. An unauthenticated, network-adjacent attacker can send a crafted GET request with encoded backslashes to read arbitrary static files under the configured root directory; directory traversal via .. is blocked. Patches are available in versions 2.0.5 and 1.19.15.
Affected products
- Hono Node.js Adapter 2.0.0 through 2.0.4, and all versions before 1.19.15
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixes released in versions 2.0.5 and 1.19.15