CVE-2026-39406 @hono/node-server has a middleware bypass via repeated slashes in serveStatic
Attackers can bypass route-based authorization middleware to access protected static files by using repeated slashes in request paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39406?
CVE-2026-39406 is a medium-severity missing authorization vulnerability in honojs node-server, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.
Weakness: CWE-22
Which versions are affected by CVE-2026-39406?
2 open source packages ship an affected version, including @hono/node-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@hono/node-server npm | All versions | 1.19.13 |
@hono/node-server npm | All versions | 1.19.13 |
Products include Hono Node-Server.
How do I fix CVE-2026-39406?
Upgrade @hono/node-server to 1.19.13 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-39406 being exploited?
There is no known exploitation of CVE-2026-39406 in the wild and no public exploit code.
Other vulnerabilities in honojs node-server
- CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
- CVE-2024-32652 @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
- CVE-2024-23340 @hono/node-server can't handle "double dots" in URL
Sources
Also known as CLEANSTART-2026-JS42957, CLEANSTART-2026-VJ30424, CLSA-2026-1793191261, CLSA-2026-1793207176, CLSA-2026-1793209463, ECHO-2090-9c99-5200 and 8 more.