CVE-2026-29087
1 advisory.
npm/@hono/node-server CVE-2026-29087: high 7.5, EPSS 0.44%
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Action: Upgrade @hono/node-server to 1.19.10 or later.
npm i @hono/node-server@1.19.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.19.10 | - |
Fixed versions
| 1.19.10 |
Sources
- osv: GHSA-wc8c-qw6v-h7f6
- https://github.com/honojs/node-server/security/advisories/GHSA-wc8c-qw6v-h7f6
- https://nvd.nist.gov/vuln/detail/CVE-2026-29087
- https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e
- https://github.com/honojs/node-server
CVE-2026-29087 · published · modified · JSON