Node-server (Honojs) - vulnerabilities (CVEs)

6 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-10-28. Vendor: Honojs.

CVEs of Node-server

• CVE-2026-118663 - CVSS 5.3 (medium), 2026-10-28: @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has…
• CVE-2026-73565 - CVSS 5.3 (medium), 2026-08-13: @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a…
• CVE-2026-39406 - CVSS 5.3 (medium), 2026-04-08: @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files…
• CVE-2026-29087 - CVSS 7.5 (high), 2026-03-06: @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with…
• CVE-2024-32652 - CVSS 7.5 (high), 2024-04-19: The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a…
• CVE-2024-23340 - CVSS 5.3 (medium), 2024-01-22: @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with…