@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

CVE-2024-23340

The CVE concerns @hono/node-server (Node.js adapter) where its custom Request.url does not resolve ". ." (double dots), causing un-resolved paths like http://localhost/static/.. /foo.txt to be passed to serveStatic. This path-traversal can enable access to unintended files on the static server, u...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...