CVE-2026-39406: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in honojs node-server
CVE-2026-39406 is a path traversal vulnerability in honojs node-server versions prior to 1. 19. 13. The issue arises from inconsistent path handling in the serveStatic function, which normalizes repeated slashes in request paths. When route-based middleware is used for authorization, paths containing repeated slashes may bypass middleware checks, allowing unauthorized access to protected static files. This vulnerability has a CVSS score of 5. 3 (medium severity) and does not affect availability or integrity, only confidentiality to a limited extent. The vulnerability is fixed in version 1. 19. 13.
AI Analysis
Technical Summary
@hono/node-server before version 1.19.13 contains a path traversal vulnerability (CWE-22) due to inconsistent path normalization between route-based middleware and the serveStatic function. Middleware authorization routes (e.g., /admin/*) may fail to match paths with repeated slashes (//), while serveStatic normalizes these paths and serves the requested static files. This discrepancy allows attackers to bypass authorization middleware and access protected static files. The issue is resolved in version 1.19.13.
Potential Impact
An attacker can bypass route-based authorization middleware by exploiting repeated slashes in request paths, gaining unauthorized read access to protected static files. The impact is limited to confidentiality loss of static file contents. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade honojs node-server to version 1.19.13 or later, where this path traversal vulnerability is fixed. Since no official patch link or advisory is provided, verify the update from the vendor's official release notes or repository. Until upgraded, avoid relying solely on route-based middleware for authorization of static files or implement additional path normalization checks.
CVE-2026-39406: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in honojs node-server
Description
CVE-2026-39406 is a path traversal vulnerability in honojs node-server versions prior to 1. 19. 13. The issue arises from inconsistent path handling in the serveStatic function, which normalizes repeated slashes in request paths. When route-based middleware is used for authorization, paths containing repeated slashes may bypass middleware checks, allowing unauthorized access to protected static files. This vulnerability has a CVSS score of 5. 3 (medium severity) and does not affect availability or integrity, only confidentiality to a limited extent. The vulnerability is fixed in version 1. 19. 13.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
@hono/node-server before version 1.19.13 contains a path traversal vulnerability (CWE-22) due to inconsistent path normalization between route-based middleware and the serveStatic function. Middleware authorization routes (e.g., /admin/*) may fail to match paths with repeated slashes (//), while serveStatic normalizes these paths and serves the requested static files. This discrepancy allows attackers to bypass authorization middleware and access protected static files. The issue is resolved in version 1.19.13.
Potential Impact
An attacker can bypass route-based authorization middleware by exploiting repeated slashes in request paths, gaining unauthorized read access to protected static files. The impact is limited to confidentiality loss of static file contents. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade honojs node-server to version 1.19.13 or later, where this path traversal vulnerability is fixed. Since no official patch link or advisory is provided, verify the update from the vendor's official release notes or repository. Until upgraded, avoid relying solely on route-based middleware for authorization of static files or implement additional path normalization checks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T00:23:30.594Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d672521cc7ad14da85d655
Added to database: 4/8/2026, 3:20:50 PM
Last enriched: 4/15/2026, 3:56:22 PM
Last updated: 5/23/2026, 11:02:25 PM
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.