# CVE-2024-23340: @hono/node-server can't handle "double dots" in URL

> Attackers can read arbitrary files via path traversal in @hono/node-server when using serveStatic with clients that do not resolve double dots.

- **Severity:** Medium 5.3 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 Jan 2024
- **Updated:** 30 May 2025
- **Also known as:** GHSA-rjq5-w47x-x359

## What is CVE-2024-23340?

CVE-2024-23340 is a medium-severity path traversal vulnerability in honojs node-server, published on 22 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.

Weakness: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

## Which versions are affected by CVE-2024-23340?

2 open source packages ship an affected version, including @hono/node-server. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@hono/node-server` | npm | From 1.3.0 | 1.4.1 |
| `@hono/node-server` | npm | From 1.3.0 | 1.4.1 |

Products: Hono Node-Server.

## How do I fix CVE-2024-23340?

Upgrade @hono/node-server to 1.4.1 or later.

## Is CVE-2024-23340 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23340 exists.

## Other vulnerabilities in honojs node-server

- [CVE-2026-29087](https://insights.sbomify.com/CVE-2026-29087/): @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (high 7.5)
- [CVE-2024-32652](https://insights.sbomify.com/CVE-2024-32652/): @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed (high 7.5)
- [CVE-2026-39406](https://insights.sbomify.com/CVE-2026-39406/): @hono/node-server has a middleware bypass via repeated slashes in serveStatic (medium 5.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-23340 and fix it if it is affected.

What it is: CVE-2024-23340 is a medium-severity path traversal vulnerability in honojs node-server, published on 22 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23340 exists.

Affected packages and fixed versions:
- @hono/node-server (npm): affected from 1.3.0; fixed in 1.4.1
- @hono/node-server (npm): affected from 1.3.0; fixed in 1.4.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-23340/ (Markdown: https://insights.sbomify.com/CVE-2024-23340/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-23340
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-23340
- OSV: https://osv.dev/vulnerability/CVE-2024-23340

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-23340/
Summaries are generated and may contain mistakes; the official description above is the record.