GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Unauthenticated attackers can read protected static files on Windows hosts by using encoded backslashes to bypass middleware guards in the Hono Node.js adapter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-frvp-7c67-39w9?
GHSA-frvp-7c67-39w9 is a path traversal vulnerability in @hono/node-server, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C).
Summary
On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.
Details
The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/* does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree.
This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.
Impact
An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.
Which versions are affected by GHSA-frvp-7c67-39w9?
4 open source packages ship an affected version, including @hono/node-server.
| Package | Affected | Fixed in |
|---|---|---|
@hono/node-server npm | All versions | 1.19.15 |
@hono/node-server npm | All versions | 1.19.15 |
@hono/node-server npm | From 2.0.0 | 2.0.5 |
@hono/node-server npm | From 2.0.0 | 2.0.5 |
How do I fix GHSA-frvp-7c67-39w9?
Upgrade @hono/node-server to a fixed version for your release line: 1.19.15 or 2.0.5.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-frvp-7c67-39w9 being exploited?
There is no known exploitation of GHSA-frvp-7c67-39w9 in the wild and no public exploit code.