Vulnerabilities

TI-2026-28388 CVE-2026-39406 · GHSA-92pp-h63x-v22m

@hono/node-server has a middleware bypass via repeated slashes in serveStatic

LOW 30

@hono/node-server allows running the Hono application on Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00383 Published 2026-04-08 Fixed in 1.19.13 CWE-22

TI-2026-23231 CVE-2026-29087 · GHSA-wc8c-qw6v-h7f6

LOW 39

@hono/node-server allows running the Hono application on Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00363 Published 2026-03-06 Fixed in 1.19.10 CWE-863

TI-2024-21534 CVE-2024-32652 · GHSA-hgxw-5xg3-69jx

MEDIUM 41

The adapter @hono/node-server allows you to run your Hono application on Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00882 Published 2024-04-19 Fixed in 1.10.1 CWE-755

TI-2024-15441 CVE-2024-23340 · GHSA-rjq5-w47x-x359

MEDIUM 63

@hono/node-server is an adapter that allows users to run Hono applications on Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00722 Published 2024-01-22 Fixed in 1.4.1 CWE-22