CVE-2024-23340 @hono/node-server can't handle "double dots" in URL
Attackers can read arbitrary files via path traversal in @hono/node-server when using serveStatic with clients that do not resolve double dots.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23340?
CVE-2024-23340 is a medium-severity path traversal vulnerability in honojs node-server, published on 22 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.
Weakness: CWE-22
Which versions are affected by CVE-2024-23340?
2 open source packages ship an affected version, including @hono/node-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@hono/node-server npm | From 1.3.0 | 1.4.1 |
@hono/node-server npm | From 1.3.0 | 1.4.1 |
Products include Hono Node-Server.
How do I fix CVE-2024-23340?
Upgrade @hono/node-server to 1.4.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23340 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23340 exists.
Other vulnerabilities in honojs node-server
- CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
- CVE-2024-32652 @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
- CVE-2026-39406 @hono/node-server has a middleware bypass via repeated slashes in serveStatic
Sources
Also known as GHSA-rjq5-w47x-x359.