DocumentationOverview
About vulnerability
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.Details
- Affected product:
- @mcp-ui/client , @mcp-ui/server , AngularJS , CopilotKit/CopilotKit , React , accounts , adk-js , adobe-design-data-agent-mcp , adobe-design-data-mcp , adobe-spectrum-design-data-mcp , ag-ui , ag-ui-aws-strands , agents , ai-sdk-devtools , ai-sdk-harness-cline , ai-sdk-harness-pi , ai-sdk-provider-claude-code , allure-codeceptjs , angular-create , angular-eslint , angular-eslint-builder , angular-eslint-schematics , browserbasehq-stagehand , claude-agent-sdk-typescript , cline , cline-sdk , cloudflare-ai-chat , cloudflare-codemode , cloudflare-think , cloudflare-voice , cloudflare-voice-twilio , cloudflare/agents , codeceptjs , composio , composio-anthropic , composio-claude-agent-sdk , configure , copilotkit-agentcore-runner , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , create-factory , earendil-works-pi-agent-core , earendil-works-pi-ai , eslint-mcp , executor-js-plugin-mcp , expo-mcp , expo/expo-mcp , ext-apps , files-sdk , fumadocs , fumadocs-ai-chat , fumadocs-graphql , fumadocs-ui , fumapress , fumapress-ai , fumapress-feedback , fumapress-graphql , fumapress-mintlify , google-adk , google-cloud-vertexai , harness-sdk , honojs/middleware , js-genai , json-render-mcp , leafygreen-ui , lynx-js-docs-mcp-server , lynx-js-genui , mastra , mastra-blaxel , mastra-client-js , mastra-code-sdk , mastra-connect , mastra-core , mastra-deployer , mastra-deployer-netlify , mastra-deployer-sandbox , mastra-deployer-vercel , mastra-factory , mastra-files-sdk , mastra-github-signals , mastra-hono , mastra-longmemeval , mastra-mcp , mastra-mcp-docs-server , mastra-observability , mastra-openai , mastra-opencode , mastra-playground-ui , mastra-react , mastra-server-adapters-test-suite , mastra-tanstack-start , mastra-tavily , mastra-temporal , mastracode , microsoft-365-agents-toolkit , mistralai-mistralai , modelcontextprotocol-ext-apps , modern.js , module-federation-core , mui-mcp , node-server , octanejs-mcp-server , office-addin-debugging , office-addin-dev-settings , openai-agents , openai-agents-extensions , openai-agents-js , openai-agents-openai , openai-agents-realtime , openuidev-lang-core , pandacss-dev , pandacss-mcp , pi , pi-mcp-adapter , prisma , remotion-mcp , scalar , scalar-void-server , sdk-typescript , shadcn , strapi-core , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-strapi , tanstack-ai-acp , tanstack-ai-claude-code , tanstack-ai-codex , tanstack-ai-grok-build , tanstack-ai-mcp , tanstack-ai-opencode , tanstack-ai-sandbox , tanstack-ai-sandbox-blaxel , tanstack-ai-sandbox-boxd , tanstack-ai-sandbox-cloudflare , tanstack-ai-sandbox-daytona , tanstack-ai-sandbox-local-process , tanstack-ai-sandbox-railway , tanstack-ai-sandbox-sprites , tanstack-ai-sandbox-vercel , temporalio-google-adk-agents , transloadit-mcp-server , tsrx-mcp , tty-table , typescript-sdk , waku , wata , workflow-world-testing , wp-playground-mcp , x402-mcp
- Affected packages:
- @hono/node-server @ 1.19.11 (+2012 more)