{"answers":{"affected":"2 open source packages ship an affected version, including @hono/node-server. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23340 exists.","fix":"Upgrade @hono/node-server to 1.4.1 or later.","what":"CVE-2024-23340 is a medium-severity path traversal vulnerability in honojs node-server, published on 22 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-23340 and fix it if it is affected.\n\nWhat it is: CVE-2024-23340 is a medium-severity path traversal vulnerability in honojs node-server, published on 22 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23340 exists.\n\nAffected packages and fixed versions:\n- @hono/node-server (npm): affected from 1.3.0; fixed in 1.4.1\n- @hono/node-server (npm): affected from 1.3.0; fixed in 1.4.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-23340/ (Markdown: https://insights.sbomify.com/CVE-2024-23340/index.md)","id":"CVE-2024-23340","markdown":"https://insights.sbomify.com/CVE-2024-23340/index.md","name":"CVE-2024-23340","record":{"aliases":["GHSA-rjq5-w47x-x359"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js web framework adapter","requires_auth":"none","summary":"Attackers can read arbitrary files via path traversal in @hono/node-server when using serveStatic with clients that do not resolve double dots.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"node-server","vendor":"hono"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"@hono/node-server can't handle \"double dots\" in URL","id":"CVE-2024-23340","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":2,"n_references":3,"next":{"headline":"TuiTse-TsuSin html injection vulnerability in `tuitse_html` function","id":"CVE-2024-23341"},"packages":[{"ecosystem":"npm","fixed":["1.4.1"],"introduced":["1.3.0"],"last_affected":[],"package":"@hono/node-server","purl":null,"source":"GHSA-rjq5-w47x-x359"},{"ecosystem":"npm","fixed":["1.4.1"],"introduced":["1.3.0"],"last_affected":[],"package":"@hono/node-server","purl":"pkg:npm/%40hono/node-server","source":"GHSA-rjq5-w47x-x359"}],"prev":{"headline":"hoolock does not block Prototype pollution with object-path related utilities","id":"CVE-2024-23339"},"products":["node-server"],"published":"2024-01-22","related":[{"cvss_score":7.5,"headline":"@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware","id":"CVE-2026-29087","kev_date_added":null,"published":"2026-03-06"},{"cvss_score":7.5,"headline":"@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed","id":"CVE-2024-32652","kev_date_added":null,"published":"2024-04-19"},{"cvss_score":5.3,"headline":"@hono/node-server has a middleware bypass via repeated slashes in serveStatic","id":"CVE-2026-39406","kev_date_added":null,"published":"2026-04-08"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-05-30","vendors":["honojs"]},"summary":"Attackers can read arbitrary files via path traversal in @hono/node-server when using serveStatic with clients that do not resolve double dots.","url":"https://insights.sbomify.com/CVE-2024-23340/"}