CVE-2026-39406: Hono Node-Server

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.

Affected products

• Hono Node-Server: up to and including 1.19.12

Published 2026-04-08. Last modified 2026-07-24.