Threats affecting pkg:npm/@hono/node-server

The @hono/node-server package's serveStatic function decodes the request path twice, allowing a crafted request to bypass middleware mounted on static file prefixes. This occurs because the router matches the encoded path after the first decode, but serveStatic resolves the file after a second decode, causing middleware to be skipped. The vulnerability does not allow directory traversal outside the configured root. It affects versions from 1.19.10 up to but not including 2.1.3. A fix is available in version 2.1.3.

A memory leak vulnerability exists in honojs node-server versions prior to 2.0.10. When a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header is sent to an upgradeWebSocket route, the IncomingMessage object is retained indefinitely due to a missing cleanup path. This allows an unauthenticated attacker to cause unbounded memory growth and potentially make the service unavailable. The issue is fixed in version 2.0.10.

A vulnerability in the @hono/node-server WebSocket adapter allows unauthenticated attackers to cause a memory leak by sending WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers. The server retains the request in memory without cleanup, leading to gradual memory exhaustion and denial of service. This affects versions 2.0.0 up to but not including 2.0.10. There is no impact on confidentiality or integrity, only availability.

A path traversal vulnerability exists in the Node.js Adapter for Hono's serve-static middleware on Windows. An attacker can use an encoded backslash (%5C) in the URL path to bypass prefix-mounted middleware protections and read static files within the configured root directory. The vulnerability does not allow escaping outside the root directory and affects Windows hosts only. It impacts versions prior to 2.0.5 and 1.19.15 of the @hono/node-server package. The vulnerability has a medium severity with a CVSS score of 5.9.