[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server@<2.0.0	>=2.0.0 → >=2.1.3

---

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

CVE-2026-73565 / GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
• https://github.com/honojs/node-server/releases/tag/v2.0.10
• https://github.com/advisories/GHSA-9mqv-5hh9-4cgg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C)

GHSA-frvp-7c67-39w9

More information

Details

The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C).

Summary

On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.

Details

The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/* does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree.

This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.

Impact

An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9
• https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf
• https://github.com/honojs/node-server/releases/tag/v2.0.5
• https://github.com/advisories/GHSA-frvp-7c67-39w9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C)

GHSA-frvp-7c67-39w9

More information

Details

The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C).

Summary

On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.

Details

The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/* does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree.

This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.

Impact

An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9
• https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.0.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

CVE-2026-73565 / GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.0.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

@​hono/node-server: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

CVE-2026-118663 / GHSA-rmxm-3fg6-px4f

More information

Details

Summary

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Details

Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f
• https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server@<2.0.0)

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

• ci: add autofix.ci by @​yusukebe in #​392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in #​390
• chore: add better benchmarks by @​BlankParticle in #​391
• docs(readme): update the benchmark by @​yusukebe in #​394
• test(request): accept asynchronous body read errors by @​usualoma in #​403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in #​402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

Compare Source

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in #​389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

Compare Source

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in #​378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in #​383

New Contributors

• @​bilal-azam made their first contribution in #​378
• @​mohamedramadan14 made their first contribution in #​383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in #​377
• perf(request): fast-path QUERY methods by @​usualoma in #​376
• perf(request): fast-path PATCH method by @​yusukebe in #​380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

Compare Source

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @​yusukebe in #​369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.6

Compare Source

What's Changed

• ci: publish to npm from CI with OIDC trusted publishing and bump np by @​yusukebe in #​361
• ci: use npm Staged publishing by @​yusukebe in #​364
• fix: preserve status and statusText when cloning a Response with liveheaders by @​usualoma in #​363

Full Changelog: honojs/node-server@v2.0.5...v2.0.6

v2.0.5

Compare Source

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

v2.0.4

Compare Source

What's Changed

• fix: stub ws types to prevent them leaking in public types by @​BlankParticle in #​359

Full Changelog: honojs/node-server@v2.0.3...v2.0.4

v2.0.3

Compare Source

What's Changed

• chore(ci): update GitHub Actions versions by @​BlankParticle in #​352
• docs: Align the ServeStaticOptions comment with the current spec by @​kakkokari-gtyih in #​356
• fix: preserve headers mutated after raw Response construction by @​abdulmunimjemal in #​357

New Contributors

• @​kakkokari-gtyih made their first contribution in #​356
• @​abdulmunimjemal made their first contribution in #​357

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

v2.0.2

Compare Source

What's Changed

• fix(serve-static): stop using file birthtime for Date header by @​usualoma in #​350
• fix: handle serveStatic stream fallback backpressure by @​usualoma in #​351

Full Changelog: honojs/node-server@v2.0.1...v2.0.2

v2.0.1

Compare Source

What's Changed

• fix: forward Hono response headers during WebSocket upgrade by @​gentamura in #​346

New Contributors

• @​gentamura made their first contribution in #​346

Full Changelog: honojs/node-server@v2.0.0...v2.0.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.