1125 matches found
roninforge-hono
roninforge-hono Cursor plugin for Hono v4 TypeScript edge web framework + TypeScript. Pinned to hono ^4.12.19, @hono/zod-validator ^0.8.0, @hono/zod-openapi ^1.4.0 peer zod ^4.x, @hono/node-server ^2.0.3 Node 20+. Teaches the v4 APIs that LLMs trained on pre-2024 data do not know c.json always...
CLSA-2026-1793698576 TuxCare security update for @hono/node-server (1 CVE)
TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.17-tuxcare.1...
Security Bulletin: vulnerability detected in informixhq-server
Summary Vulerabiltity in web component [email protected] Vulnerability Details CVEID:CVE-2026-84363 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as...
CVE-2026-118663
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
0agent (>=1.0.1, <=1.1.5), 128981semzub (1.0.1) +8095 more potentially affected by CVE-2026-118663 via @hono/node-server (>=1.19.10, <=2.1.1)
@hono/node-server NPM version =1.19.10, =1.0.1, =0.1.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.16.8, =0.63.0, =0.63.0, =0.1.1, =0.38.0, =0.40.0-beta.2 and more Source cves: CVE-2026-118663 Source advisory: GHSA-RMXM-3FG6-PX4F...
GHSA-RMXM-3FG6-PX4F @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...
0agent (>=1.0.1, <=1.1.5), 128981semzub (1.0.1) +8095 more potentially affected by CVE-2026-118663 via @hono/node-server (>=1.19.10, <=2.1.1)
@hono/node-server NPM version =1.19.10, =1.0.1, =0.1.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.16.8, =0.63.0, =0.63.0, =0.1.1, =0.38.0, =0.40.0-beta.2 and more Source cves: CVE-2026-118663 Source advisory: SNYK:JS-HONONODESERVER-21802762...
Double Decoding of the Same Data
Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Double Decoding of the Same Data via the serveStatic middleware in src/serve-static.ts, where a percent-encoded path sequence in a request URL is decoded by tryDecodeURI before the path...
0agent (>=1.0.1, <=1.1.5), 128981semzub (1.0.1) +8095 more potentially affected by CVE-2026-118663 via @hono/node-server (>=1.19.10, <=2.1.1)
@hono/node-server NPM version =1.19.10, =1.0.1, =0.1.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.16.8, =0.63.0, =0.63.0, =0.1.1, =0.38.0, =0.40.0-beta.2 and more Source cves: CVE-2026-118663 Source advisory: OSV:GHSA-RMXM-3FG6-PX4F...
EUVD-2026-112470
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118663
The @hono/node-server library (versions 1.19.10 through 2.1.3) is vulnerable to a middleware bypass due to double decoding of the request path. Specifically, the serveStatic function decodes the path a second time after Hono has already performed decoding for routing. An unauthenticated attacker ...
CVE-2026-118663
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
0agent (>=1.0.1, <=1.1.5), 128981semzub (1.0.1) +8095 more potentially affected by CVE-2026-118663 via @hono/node-server (>=1.19.10, <=2.1.1)
@hono/node-server NPM version =1.19.10, =1.0.1, =0.1.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.16.8, =0.63.0, =0.63.0, =0.1.1, =0.38.0, =0.40.0-beta.2 and more Source cves: CVE-2026-118663 Source advisory: MEND:CVE-2026-118663...
CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...
CLSA-2026-1793209463 TuxCare security update for @hono/node-server (1 CVE)
TuxCare rebuilt @hono/node-server to address 1 CVE. Fixed in 1.19.9-tuxcare.2...