A path traversal vulnerability exists in the Node.js Adapter for Hono's serve-static middleware on Windows. An attacker can use an encoded backslash (%5C) in the URL path to bypass prefix-mounted middleware protections and read static files within the configured root directory. The vulnerability does not allow escaping outside the root directory and affects Windows hosts only. It impacts versions prior to 2.0.5 and 1.19.15 of the @hono/node-server package. The vulnerability has a medium severity with a CVSS score of 5.9.