npm/@hono/node-server CVE-2026-39406: medium 5.3, EPSS 0.40%
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Action: Upgrade @hono/node-server to 1.19.13 or later.
npm i @hono/node-server@1.19.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.19.13 | - |
Fixed versions
| 1.19.13 |
Sources
- osv: GHSA-92pp-h63x-v22m
- https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m
- https://nvd.nist.gov/vuln/detail/CVE-2026-39406
- https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2
- https://github.com/honojs/node-server
- https://github.com/honojs/node-server/releases/tag/v1.19.13
CVE-2026-39406 · published · modified · JSON