@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths.
MediumGHSA-rmxm-3fg6-px4fCVE-2026-11866328 Oct · yesterday
Does it affect you?
0/3All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory database
Timeline
28 Oct47 minfrom publication to Patchwire
- Published in the GitHub database28 Oct, 21:05 UTC
- Seen by Patchwire +47 min28 Oct, 21:52 UTC
@hono/node-server2.1.3
Versions of @hono/node-server
2.x
safe 2.1.3
AffectedSafe