Directory Traversal

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Directory Traversal due to inconsistent handling of repeated slashes in the serveStatic process. An attacker can access sensitive static files that are intended to be protected by bypassin...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +274 more potentially affected by CVE-2026-39406 via @hono/node-server (>=1.0.2, <=1.19.12)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.3.1, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1-alpha.25, =0.0.0-alpha.1, =0.0.27, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alstar/studio 0.0.0-beta.20 and more Source cves:...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +274 more potentially affected by CVE-2026-39406 via @hono/node-server (>=1.0.2, <=1.19.12)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.3.1, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1-alpha.25, =0.0.0-alpha.1, =0.0.27, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alstar/studio 0.0.0-beta.20 and more Source cves:...

EUVD-2026-20491

@hono/node-server: Middleware bypass via repeated slashes in serveStatic...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +274 more potentially affected by CVE-2026-39406 via @hono/node-server (>=1.0.2, <=1.19.12)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.3.1, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1-alpha.25, =0.0.0-alpha.1, =0.0.27, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alstar/studio 0.0.0-beta.20 and more Source cves:...

CVE-2026-39406: Improper Limitation of a Pathname to a Restricted Directory

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the...

CVE-2026-31949

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...

CVE-2026-3966

CVE-2026-3966 affects the 648540858 wvp-GB28181-pro package up to version 2.7.4-20260107. The issue lies in the getDownloadFilePath function of ABLMediaNodeServerService.java under the IP Address Handler; manipulating the MediaServer.streamIp argument triggers server-side request forgery (SSRF). ...

CVE-2026-29087

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

CVE-2026-29087

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +236 more potentially affected by CVE-2026-29087 via @hono/node-server (>=0.2.4, <=1.19.9)

@hono/node-server NPM version =0.2.4, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.29.3, =0.30.1 - @arpanjain3.14/ponder-with-flashblocks 0.16.3 and more Source cves: CVE-2026-29087 Source advisory:...

CVE-2026-29087

The connected IBM bulletin confirms CVE-2026-29087 affects the Node.js module hono used by IBM App Connect Enterprise Certified Container. The vulnerability arises from inconsistent URL decoding when static file serving and route-middleware protections are used together, allowing access to protec...

CVE-2026-29087: Incorrect Authorization

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed...

GHSA-WC8C-QW6V-H7F6 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...