The honojs node-server before version 1.19.13 contains a path traversal vulnerability (CWE-22) due to inconsistent handling of repeated slashes in URL paths. The serveStatic function normalizes paths by collapsing repeated slashes, while route-based middleware authorization (e.g., routes like /admin/*) may fail to match these altered paths correctly. This discrepancy allows an attacker to bypass authorization middleware by crafting request paths with repeated slashes, thereby accessing protected static files. The issue is resolved in honojs node-server version 1.19.13.

An attacker can bypass route-based middleware authorization controls by exploiting the path normalization inconsistency, potentially gaining unauthorized read access to protected static files. The vulnerability does not affect integrity or availability, only confidentiality of static file resources. There are no known exploits in the wild at this time.

Upgrade honojs node-server to version 1.19.13 or later, where this path traversal vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this update is the recommended remediation. Patch status is not explicitly stated beyond the version fix, so verify with the vendor for any additional guidance.