Executive brief
A vulnerability in the Hono Node.js adapter allows unauthorized access to files on Windows-based servers. By using a specifically formatted web address, an attacker can bypass security rules intended to protect certain folders and read files they should not have access to. This could lead to the exposure of sensitive configuration files or internal data stored on the server.
Technical details
A path traversal vulnerability exists in the `serve-static` component of the Hono Node.js adapter when running on Windows. The issue stems from the router only splitting paths on forward slashes (`/`), while the Windows path resolver treats encoded backslashes (`%5C`) as directory separators. An attacker can craft a request like `/admin%5Csecret.txt` which the Hono router treats as a single segment, bypassing middleware mounted on `/admin/*`. When passed to the Windows file system, the path is resolved as `admin\secret.txt`, allowing the attacker to read files within the static root that were intended to be protected by middleware. This does not allow for directory escape outside of the configured static root. The issue is fixed in version 2.0.5.
Affected products
- Hono @hono/node-server < 2.0.5
Timeline
- 2026-06-15: patched: Version 2.0.5 released
- 2026-07-21: advisory: GitHub Advisory published