{"id":"CVE-2026-39406","aliases":["CLSA-2026-1793191261","CLSA-2026-1793207176","CLSA-2026-1793209463","CLSA-2026-1793630460","CLSA-2026-1793630496","EUVD-2026-20491","GHSA-92pp-h63x-v22m","GHSA-frvp-7c67-39w9"],"status":"published","title":"@hono/node-server has a middleware bypass via repeated slashes in serveStatic","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00383,"percentile":0.32743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-08T00:16:39Z","modified":"2026-11-02T19:47:02Z","fixes":[{"ecosystem":"npm","package":"@hono/node-server","fixed_in":["1.19.13","2.0.5","1.19.15"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@hono/node-server","fixed_in":["1.19.11-tuxcare.1","1.19.10-tuxcare.1","1.19.9-tuxcare.2","1.19.10-tuxcare.2","1.19.9-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.13"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.15"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.11-tuxcare.0"},{"fixed":"1.19.11-tuxcare.1"}]}],"versions":["1.19.11"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.10-tuxcare.0"},{"fixed":"1.19.10-tuxcare.1"}]}],"versions":["1.19.10"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.9-tuxcare.0"},{"fixed":"1.19.9-tuxcare.2"}]}],"versions":["1.19.9","1.19.9-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.10-tuxcare.0"},{"fixed":"1.19.10-tuxcare.2"}]}],"versions":["1.19.10","1.19.10-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.9-tuxcare.0"},{"fixed":"1.19.9-tuxcare.3"}]}],"versions":["1.19.9","1.19.9-tuxcare.1","1.19.9-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.13"}]}]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.15"}]}]}],"products":[{"vendor":"hono","product":"node-server"},{"vendor":"honojs","product":"node-server"}],"references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2","tags":["web"]},{"url":"https://github.com/honojs/node-server/releases/tag/v1.19.13","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39406","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-92pp-h63x-v22m"},{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9","tags":["web"]},{"url":"https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf","tags":["web"]},{"url":"https://github.com/honojs/node-server/releases/tag/v2.0.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-frvp-7c67-39w9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39406.json","tags":["advisory"]},{"url":"https://github.com/honojs/node-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39406","title":"@hono/node-server has a middleware bypass via repeated slashes in serveStatic","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","status":"published","published":"2026-04-08T14:34:30.543Z","modified":"2026-04-08T15:17:38.121Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-20491","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","status":"published","published":"2026-04-08T14:34:30Z","modified":"2026-04-08T15:17:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:12.037386Z"}],"ghsa":[{"id":"GHSA-92pp-h63x-v22m","title":"@hono/node-server: Middleware bypass via repeated slashes in serveStatic","description":"## Summary\n\nA path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the request path.\n\nWhen route-based middleware (e.g., `/admin/*`) is used for authorization, the router may not match paths containing repeated slashes, while `serveStatic` resolves them as normalized paths. This can lead to a middleware bypass.\n\n## Details\n\nThe routing layer and `serveStatic` handle repeated slashes differently.\n\nFor example:\n\n- `/admin/secret.txt` =\u003e matches `/admin/*`\n- `//admin/secret.txt` =\u003e may not match `/admin/*`\n\nThis inconsistency allows a request such as:\n\n```\nGET //admin/secret.txt\n```\n\nto bypass middleware registered on `/admin/*` and access protected files.\n\n## Impact\n\nAn attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path.\n\nThis can lead to unauthorized access to sensitive files under the static root.\n\nThis issue affects applications that rely on `serveStatic` together with route-based middleware for access control.","status":"published","published":"2026-04-08T00:16:39Z","modified":"2026-04-08T15:34:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:51.193071Z"},{"id":"GHSA-frvp-7c67-39w9","title":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","description":"The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (`..`) remains blocked.\n\n### Details\n\nThe router splits paths only on `/`, so `/admin%5Csecret.txt` is one segment and middleware on `/admin/*` does not run. The `serve-static` guard rejects `.`/`..` and consecutive separators but lets a lone `\\` through; on Windows the file resolver re-splits it into the protected subtree.\n\nThis affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.\n\n### Impact\n\nAn unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.","status":"published","published":"2026-07-21T18:17:25Z","modified":"2026-08-12T18:26:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-39406","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","status":"published","published":"2026-04-08T15:16:14.513Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-39406","title":"@hono/node-server has a middleware bypass via repeated slashes in serveStatic","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","status":"published","published":"2026-04-08T14:34:30.543Z","modified":"2026-10-28T02:31:09.571271939Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-92pp-h63x-v22m","title":"@hono/node-server: Middleware bypass via repeated slashes in serveStatic","description":"## Summary\n\nA path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the request path.\n\nWhen route-based middleware (e.g., `/admin/*`) is used for authorization, the router may not match paths containing repeated slashes, while `serveStatic` resolves them as normalized paths. This can lead to a middleware bypass.\n\n## Details\n\nThe routing layer and `serveStatic` handle repeated slashes differently.\n\nFor example:\n\n- `/admin/secret.txt` =\u003e matches `/admin/*`\n- `//admin/secret.txt` =\u003e may not match `/admin/*`\n\nThis inconsistency allows a request such as:\n\n```\nGET //admin/secret.txt\n```\n\nto bypass middleware registered on `/admin/*` and access protected files.\n\n## Impact\n\nAn attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path.\n\nThis can lead to unauthorized access to sensitive files under the static root.\n\nThis issue affects applications that rely on `serveStatic` together with route-based middleware for access control.","status":"published","published":"2026-04-08T00:16:39Z","modified":"2026-09-10T03:51:01.299551704Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-frvp-7c67-39w9","title":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","description":"The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (`..`) remains blocked.\n\n### Details\n\nThe router splits paths only on `/`, so `/admin%5Csecret.txt` is one segment and middleware on `/admin/*` does not run. The `serve-static` guard rejects `.`/`..` and consecutive separators but lets a lone `\\` through; on Windows the file resolver re-splits it into the protected subtree.\n\nThis affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.\n\n### Impact\n\nAn unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.","status":"published","published":"2026-07-21T18:17:25Z","modified":"2026-09-10T03:50:51.945277237Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"CLSA-2026-1793191261","title":"TuxCare security update for @hono/node-server (2 CVEs)","description":"TuxCare rebuilt @hono/node-server to address 2 CVEs. Fixed in 1.19.11-tuxcare.1.","status":"published","published":"2026-10-28T12:41:01Z","modified":"2026-10-28T13:45:14.322943023Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793207176","title":"TuxCare security update for @hono/node-server (1 CVE)","description":"TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.10-tuxcare.1.","status":"published","published":"2026-10-28T17:06:16Z","modified":"2026-10-28T19:45:13.704515005Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209463","title":"TuxCare security update for @hono/node-server (1 CVE)","description":"TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.9-tuxcare.2.","status":"published","published":"2026-10-28T17:44:23Z","modified":"2026-10-28T19:45:12.952757683Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793630460","title":"TuxCare security update for @hono/node-server (1 CVE)","description":"TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.10-tuxcare.2.","status":"published","published":"2026-11-02T15:41:01Z","modified":"2026-11-02T19:47:02.909791768Z","updated_at":"2026-11-02T20:28:06.90948Z"},{"id":"CLSA-2026-1793630496","title":"TuxCare security update for @hono/node-server (1 CVE)","description":"TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.9-tuxcare.3.","status":"published","published":"2026-11-02T15:41:37Z","modified":"2026-11-02T19:47:02.949794003Z","updated_at":"2026-11-02T20:28:06.90948Z"}]}}