{"id":"CVE-2024-23340","aliases":["EUVD-2024-0418","GHSA-rjq5-w47x-x359"],"status":"published","title":"@hono/node-server can't handle \"double dots\" in URL","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00722,"percentile":0.54318,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-01-22T23:00:34Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"npm","package":"@hono/node-server","fixed_in":["1.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.4.1"}]}]}],"products":[{"vendor":"hono","product":"node-server"},{"vendor":"honojs","product":"node-server"}],"references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rjq5-w47x-x359"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23340.json","tags":["advisory"]},{"url":"https://github.com/honojs/node-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23340","title":"@hono/node-server can't handle \"double dots\" in URL","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.\n\n","status":"published","published":"2024-01-22T23:00:34.51Z","modified":"2025-05-30T14:21:51.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0418","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.\n\n","status":"published","published":"2024-01-22T23:00:34Z","modified":"2025-05-30T14:21:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:34.547192Z"}],"ghsa":[{"id":"GHSA-rjq5-w47x-x359","title":"@hono/node-server cannot handle \"double dots\" in URL","description":"### Impact\n\nSince v1.3.0, we use our own Request object. This is great, but the `url` behavior is unexpected.\n\nIn the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path.\n\n```ts\nconst req = new Request('http://localhost/static/../foo.txt') // Web-standards\nconsole.log(req.url) // http://localhost/foo.txt\n```\n\nHowever, the `url` in our Request does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned.\n\n```ts\nconst req = new Request('http://localhost/static/../foo.txt')\nconsole.log(req.url) // http://localhost/static/../foo.txt\n```\n\nIt will pass unresolved paths to the web application. This causes vulnerabilities like #123 when using `serveStatic`.\n\nNote: Modern web browsers and a latest `curl` command resolve double dots on the client side, so it does not affect you if the user uses them. However, problems may occur if accessed by a client that does not resolve them.\n\n### Patches\n\n\"v1.4.1\" includes the change to fix this issue.\n\n### Workarounds\n\nDon't use `serveStatic`.\n\n","status":"published","published":"2024-01-23T14:42:51Z","modified":"2024-01-23T14:42:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2024-23340","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.\n\n","status":"published","published":"2024-01-22T23:15:08.637Z","modified":"2026-06-17T07:12:37.777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23340","title":"@hono/node-server can't handle \"double dots\" in URL","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.\n\n","status":"published","published":"2024-01-22T23:00:34.51Z","modified":"2026-10-28T02:30:25.142087947Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-rjq5-w47x-x359","title":"@hono/node-server cannot handle \"double dots\" in URL","description":"### Impact\n\nSince v1.3.0, we use our own Request object. This is great, but the `url` behavior is unexpected.\n\nIn the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path.\n\n```ts\nconst req = new Request('http://localhost/static/../foo.txt') // Web-standards\nconsole.log(req.url) // http://localhost/foo.txt\n```\n\nHowever, the `url` in our Request does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned.\n\n```ts\nconst req = new Request('http://localhost/static/../foo.txt')\nconsole.log(req.url) // http://localhost/static/../foo.txt\n```\n\nIt will pass unresolved paths to the web application. This causes vulnerabilities like #123 when using `serveStatic`.\n\nNote: Modern web browsers and a latest `curl` command resolve double dots on the client side, so it does not affect you if the user uses them. However, problems may occur if accessed by a client that does not resolve them.\n\n### Patches\n\n\"v1.4.1\" includes the change to fix this issue.\n\n### Workarounds\n\nDon't use `serveStatic`.\n\n","status":"published","published":"2024-01-23T14:42:51Z","modified":"2026-09-10T03:50:05.180372542Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}