@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling
    inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//)
    in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router
    may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This
    can lead to a middleware bypass. This vulnerability is fixed in 1.19.13. (CVE-2026-39406)

ID	Name	Product	Family	Type	Severity
460041	Echo: @hono/node-server: security update to 1.19.13	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460041	Echo: @hono/node-server: security update to 1.19.13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
439984	SCA: security update for @hono/node-server (GHSA-92pp-h63x-v22m)	Tenable Cloud Security	SCA Checks	Local	medium
439984	SCA: security update for @hono/node-server (GHSA-92pp-h63x-v22m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-39406

medium

Tenable Plugins

medium

medium

medium

medium