GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

Directory Traversal

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Directory Traversal due to inconsistent handling of repeated slashes in the serveStatic process. An attacker can access sensitive static files that are intended to be protected by bypassin...

Node.js Adapter for Hono 路径遍历漏洞

The Node.js Adapter for Hono is an open-source tool developed by Hono, designed to run Hono applications on Node.js. Versions of the Node.js Adapter for Hono prior to 1.19.13 contained a path traversal vulnerability. This vulnerability stemmed from inconsistent path handling, allowing access to...