{"action":"Upgrade @hono/node-server to 1.19.15 or later.","affected":[{"fixed":"2.0.5","introduced":"2.0.0"},{"fixed":"1.19.15","introduced":"0"}],"component":"@hono/node-server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.0.5","1.19.15"],"ghsa_id":"GHSA-frvp-7c67-39w9","id":"tcs_01M5KFP886XQRZAE48APNK2TX1","modified_at":"2026-09-10T03:50:51.945277237Z","published_at":"2026-07-21T18:17:25Z","references":["https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9","https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9","https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf","https://github.com/honojs/node-server","https://github.com/honojs/node-server/releases/tag/v2.0.5"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-frvp-7c67-39w9","url":"https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9"}],"summary":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)"}