honojs node-server vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20264

Newest CVEs

• CVE-2026-118663

  @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

  honojs · node-server

  Medium5.3
• CVE-2026-73565

  @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

  honojs · node-server

  Medium5.3
• CVE-2026-39406

  @hono/node-server has a middleware bypass via repeated slashes in serveStatic

  honojs · node-server

  Medium5.3
• CVE-2026-29087

  @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

  honojs · node-server

  High7.5
• CVE-2024-32652

  @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

  honojs · node-server

  High7.5
• CVE-2024-23340

  @hono/node-server can't handle "double dots" in URL

  honojs · node-server

  Medium5.3