npm/@hono/node-server

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

Modified: 9/10/2026

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Modified: 8/13/2026

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

Modified: 9/10/2026

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

Modified: 9/10/2026

@hono/node-server cannot handle "double dots" in URL

Modified: 9/10/2026

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Modified: 9/10/2026