🚨 [security] Update @hono/node-server 1.19.7 → 1.19.13 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​hono/node-server (1.19.7 → 1.19.13) · Repo

Security Advisories 🚨

🚨 @hono/node-server: Middleware bypass via repeated slashes in serveStatic

Summary

A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path.

When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass.

Details

The routing layer and serveStatic handle repeated slashes differently.

For example:

• /admin/secret.txt => matches /admin/*
• //admin/secret.txt => may not match /admin/*

This inconsistency allows a request such as:

GET //admin/secret.txt

to bypass middleware registered on /admin/* and access protected files.

Impact

An attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path.

This can lead to unauthorized access to sensitive files under the static root.

This issue affects applications that rely on serveStatic together with route-based middleware for access control.

🚨 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Summary

When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization.

In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served.

Details

The routing layer and the node-server static handler normalize request paths differently. The router preserves %2F as a literal string when matching routes, while the static handler decodes %2F into / before resolving the filesystem path.

Example request:

• /admin%2Fsecret.html

This may:

• fail to match middleware intended for /admin/*, but
• still be resolved by the static handler as /admin/secret.html under the configured static root.

This does not allow access outside the configured static root and is not a path traversal vulnerability.

Impact

An unauthenticated attacker could bypass route-based authorization protections for protected static resources by supplying paths containing encoded slashes.

Applications relying solely on route-based middleware to protect static subpaths under the same static root may have exposed those resources.

Release Notes

1.19.12

What's Changed

• chore: ignore claude setting by @yusukebe in #314
• fix: request draining for early 413 responses by @usualoma in #329

Full Changelog: v1.19.11...v1.19.12

1.19.11

What's Changed

• fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @usualoma in #309

Full Changelog: v1.19.10...v1.19.11

1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

1.19.9

What's Changed

• fix(globals): Stop overwriting global.fetch by @usualoma in #295

Full Changelog: v1.19.8...v1.19.9

1.19.8

What's Changed

• docs: add guide for listening to UNIX domain socket by @TransparentLC in #292
• fix(serve-static): Use Readable.toWeb in serveStatic by @otya128 in #293

New Contributors

• @TransparentLC made their first contribution in #292
• @otya128 made their first contribution in #293

Full Changelog: v1.19.7...v1.19.8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 17 commits:

• 1.19.13
• Merge commit from fork
• 1.19.12
• fix: request draining for early 413 responses (#329)
• chore: ignore claude setting (#314)
• 1.19.11
• fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. (#309)
• 1.19.10
• Merge commit from fork
• chore: add benchmark for comparing with npm and local (dev) (#305)
• chore: Adding LICENSE file with MIT license referenced in README.md (#297)
• docs(readme): add @usualoma as an author (#300)
• 1.19.9
• fix(globals): Stop overwriting global.fetch (#295)
• 1.19.8
• fix(serve-static): Use Readable.toWeb in serveStatic (#293)
• docs: add guide for listening to UNIX domain socket (#292)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​hono/​node-server@​1.19.7 ⏵ 1.19.13	+1	+18		-1

View full report