Node server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

On Windows hosts, the Node.js Adapter for Hono's serve-static middleware improperly handles encoded backslashes (%5C) in request paths. The encoded backslash decodes to a backslash character (\), which Windows treats as a path separator. This causes the middleware to misinterpret a single URL segment containing a backslash as a nested path, allowing an attacker to read static files protected by prefix-mounted middleware. The router splits paths only on '/', so middleware guarding paths like '/admin/*' does not execute for requests like '/admin%5Csecret.txt'. The vulnerability does not permit directory traversal outside the root directory as '.' and '..' are still blocked. This issue affects Windows hosts using Node, Bun, or Deno adapters serving static files with prefix-mounted middleware.

An unauthenticated attacker can read static files located under middleware-guarded prefixes on Windows hosts running affected versions of the @hono/node-server. The attacker cannot escape the configured root directory but can access files that should be protected by middleware. This could lead to unauthorized disclosure of sensitive static files.

A patch is available for this vulnerability. Users should upgrade to version 2.0.5 or later (and 1.19.15 or later if applicable) of the @hono/node-server package to remediate this issue. No additional mitigation steps are required if the patch is applied.