What’s Vulnerable › Products

honojs node-server vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your honojs node-server version is affected

Latest honojs node-server vulnerabilities

• CVE-2026-118663 — @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths (CVSS 5.3)
• CVE-2026-73565 — @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake (CVSS 5.3)
• CVE-2026-39406 — @hono/node-server has a middleware bypass via repeated slashes in serveStatic (CVSS 5.3)
• CVE-2026-29087 — @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (CVSS 7.5)
• CVE-2024-32652 — @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed (CVSS 7.5)
• CVE-2024-23340 — @hono/node-server can't handle "double dots" in URL (CVSS 5.3)