@hono/node-server
2.1.5 · 13 Oct 2026MIT42.6M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @hono/node-server. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.1.5 | Safe from 2.0.10 | |
| 1.19.17 | Safe from 1.19.15 | |
| 0.6.0 | 15 open advisories, worst high · last release Apr 2023, no longer updated |
- High@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static MiddlewareGHSA-wc8c-qw6v-h7f6 · 4 Mar 2026
- 1.x1.0.0 – 1.19.9Fixed in 1.19.10
- 0.6.x and older0.2.0 – 0.6.0No fix, no longer updated · move to 1.19.10
- High@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsedGHSA-hgxw-5xg3-69jx · 19 Apr 2024
- 1.x1.3.0 – 1.10.0Fixed in 1.10.1
- ModerateNode.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshakeGHSA-9mqv-5hh9-4cgg · 21 Jul 2026
- 2.x2.0.0 – 2.0.9Fixed in 2.0.10
- ModerateNode.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)GHSA-frvp-7c67-39w9 · 21 Jul 2026
- 2.x2.0.0 – 2.0.4Fixed in 2.0.5
- 1.x1.0.0 – 1.19.14Fixed in 1.19.15
- 0.6.x and older0.2.0 – 0.6.0No fix, no longer updated · move to 1.19.15
- Moderate@hono/node-server: Middleware bypass via repeated slashes in serveStaticGHSA-92pp-h63x-v22m · 8 Apr 2026
- 1.x1.0.0 – 1.19.12Fixed in 1.19.13
- 0.6.x and older0.2.0 – 0.6.0No fix, no longer updated · move to 1.19.13
- Moderate@hono/node-server cannot handle "double dots" in URLGHSA-rjq5-w47x-x359 · 23 Jan 2024
- 1.x1.3.0 – 1.4.0Fixed in 1.4.1
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.