{"id":"GHSA-92pp-h63x-v22m","revision":null,"records":[{"revision":"b74365d8e6dc44e4894255f5769cc8f2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-39406","aliases":[],"title":"@hono/node-server has a middleware bypass via repeated slashes in serveStatic","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","state":0,"publishedAt":"2026-04-08T14:34:30.543+00:00","modifiedAt":"2026-04-08T15:17:38.121+00:00","affected":[{"ecosystem":"Vendor product","name":"node-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"honojs\",\n                    \"product\": \"node-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.19.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-39406","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-39406","identifiers":["CVE-2026-39406"]},"retained":false,"historicalAffected":[]},{"revision":"077fd0b046b641dc824f2b6efc9fb25a","observedAt":"2026-11-13T10:04:06.166+00:00","statement":{"source":"euvd","id":"EUVD-2026-20491","aliases":["CVE-2026-39406","GHSA-92pp-h63x-v22m"],"title":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-bas…","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20491","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 8, 2026, 2:34:30 PM","dateUpdated":"Apr 8, 2026, 3:17:38 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-1407","title":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-26013","CVE-2026-27142","CVE-2026-28277","CVE-2026-28684","CVE-2026-32288","CVE-2026-33151","CVE-2026-33349","CVE-2026-33532","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33916","CVE-2026-34601","CVE-2026-35469","CVE-2026-39406","CVE-2026-39407","CVE-2026-39408","CVE-2026-39409","CVE-2026-39410","CVE-2026-39983","CVE-2026-40175","CVE-2026-40347","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-4923","CVE-2026-4926"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-20491","identifiers":["EUVD-2026-20491","CVE-2026-39406","GHSA-92pp-h63x-v22m"]},"retained":false,"historicalAffected":[]},{"revision":"5e814d90042a4e9b813a11750c933a3b","observedAt":"2026-10-25T09:17:18.747+00:00","statement":{"source":"nvd","id":"CVE-2026-39406","aliases":[],"title":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-bas…","description":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.","state":0,"publishedAt":"2026-04-08T15:16:14.513+00:00","modifiedAt":"2026-07-24T21:10:00.143+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39406","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-08T15:16:14.513","lastModified":"2026-07-24T21:10:00.143"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-39406","identifiers":["CVE-2026-39406"]},"retained":false,"historicalAffected":[]},{"revision":"8995ee5de4e843c38deb5bd256251fda","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-92pp-h63x-v22m","aliases":["CVE-2026-39406"],"title":"@hono/node-server: Middleware bypass via repeated slashes in serveStatic","description":"## Summary\n\nA path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the request path.\n\nWhen route-based middleware (e.g., `/admin/*`) is used for authorization, the router may not match paths containing repeated slashes, while `serveStatic` resolves them as normalized paths. This can lead to a middleware bypass.\n\n## Details\n\nThe routing layer and `serveStatic` handle repeated slashes differently.\n\nFor example:\n\n- `/admin/secret.txt` => matches `/admin/*`\n- `//admin/secret.txt` => may not match `/admin/*`\n\nThis inconsistency allows a request such as:\n\n```\nGET //admin/secret.txt\n```\n\nto bypass middleware registered on `/admin/*` and access protected files.\n\n## Impact\n\nAn attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path.\n\nThis can lead to unauthorized access to sensitive files under the static root.\n\nThis issue affects applications that rely on `serveStatic` together with route-based middleware for access control.","state":0,"publishedAt":"2026-04-08T00:16:39+00:00","modifiedAt":"2026-09-10T03:51:01.2995517+00:00","affected":[{"ecosystem":"npm","name":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.19.13"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22m","https://nvd.nist.gov/vuln/detail/CVE-2026-39406","https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2","https://github.com/honojs/node-server","https://github.com/honojs/node-server/releases/tag/v1.19.13"],"sourceUrl":"https://github.com/advisories/GHSA-92pp-h63x-v22m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-92pp-h63x-v22m","identifiers":["GHSA-92pp-h63x-v22m","CVE-2026-39406"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5204338+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5204347+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-576973bd2a8c36ed3d013750ca82fcede7b10fe95f071dbe9a6a4dd94759ab84","complete":true,"records":425782,"lastAttemptAt":"2026-11-15T07:30:53.2515651+00:00","lastSuccessAt":"2026-11-15T07:30:53.2350398+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.2515651+00:00","snapshotPublishedAt":"2026-11-15T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-51c4fdbdf1b54dc7b4fe83e6e1ed4b96","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T07:46:53.2479496+00:00","lastSuccessAt":"2026-11-15T07:46:53.241+00:00","error":"82 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T07:46:53.241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13488,"expectedIdentifiers":13874,"failedIdentifiers":82},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5213705+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5213739+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35abf047bdfe46089a52c4c139c37942","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T07:31:01.665293+00:00","lastSuccessAt":"2026-11-15T05:33:23.837+00:00","error":"12 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T05:33:23.837+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13862,"expectedIdentifiers":13874,"failedIdentifiers":12},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T07:30:53.9403022+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.9403022+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T07:30:53.3921516+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.3921516+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T07:30:54.2664324+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.2664324+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-878f718ccd076f540460423958c8e379b139b997b45858275573ecc4d702fe9a","complete":true,"records":232474,"lastAttemptAt":"2026-11-15T07:30:53.7776854+00:00","lastSuccessAt":"2026-11-15T05:33:06.8241102+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.7776854+00:00","snapshotPublishedAt":"2026-11-15T04:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}