@hono/node-server: Middleware bypass via repeated slashes in serveStatic (CVE-2026-39406) | HOL Guard CVE

Medium · CVSS 5.3CVE-2026-39406GHSA-92PP-H63X-V22M

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

Answer in brief

CVE-2026-39406 records a Medium severity (CVSS 5.3) vulnerability in @hono/node-server: Middleware bypass via repeated slashes in serveStatic. The current sources do not mark it as known exploited. The current feed maps @hono/node-server (npm). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Apr 8, 2026Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Sep 10, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.3
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps @hono/node-server (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
@hono/node-servernpm	>=0 <1.19.13	1.19.13

Recommended response

Check inventory. Check lockfiles and deployed manifests for @hono/node-server.
Review the reported fix. Update @hono/node-server to 1.19.13 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Apr 8, 2026
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the request path. When route-based middleware (e.g., `/admin/*`) is used for authorization, the router may not match paths containing repeated slashes, while `serveStatic` resolves them as normalized paths. This can lead to a middleware bypass. ## Details The routing layer and `serveStatic` handle repeated slashes differently. For example: - `/admin/secret.txt` => matches `/admin/*` - `//admin/secret.txt` => may not match `/admin/*` This inconsistency allows a request such as: ``` GET //admin/secret.txt ``` to bypass middleware registered on `/admin/*` and access protected files. ## Impact An attacker can access static files that are intended to be protected by route-based middleware by using repeated slashes in the request path. This can lead to unauthorized access to sensitive files under the static root. This issue affects applications that rely on `serveStatic` together with route-based middleware for access control.

Quoted source text, attributed separately from HOL analysis.