`@hono/node-server`

Ecosystem:
npm

Package URL:
pkg:npm/@hono/node-server

Total PRs:
4,097 Dependabot PRs

Latest PR:
about 17 hours ago

Unique Repositories:
1,647 repositories

Unique Repos (30 days):
170 repositories

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

GHSA-92pp-h63x-v22m CVE-2026-39406 MODERATE published about 2 months ago • updated 5 days ago

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the req...

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

GHSA-hgxw-5xg3-69jx CVE-2024-32652 HIGH published about 2 years ago • updated about 21 hours ago

### Impact The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those th...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

GHSA-wc8c-qw6v-h7f6 CVE-2026-29087 HIGH published 3 months ago • updated 7 days ago

## Summary When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), incon...

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

statico/ycombinator1.com #8

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps)(deps): bump @hono/node-server from 1.19.10 to 1.19.13

dcyfr/dcyfr-labs #391

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 6 comments

chore(deps): bump @hono/node-server from 1.19.12 to 1.19.13

zalatar242/folio #42

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13 in /docs/en/documentation/getting-started/quickstart/js/adk

googleapis/mcp-toolbox #2981

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 6 comments

deps(npm): bump @hono/node-server from 1.19.11 to 1.19.13 in /dependencies

sede-open/super-linter #16

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

chittyos/chittyconnect #150

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

kduprey/wef-site #742

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.11 to 1.19.14 in /container/agent-runner

jokim1/clawtalk #240

1.19.11 → 1.19.14 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

adzukimame/summaly-lambda #268

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Chore(deps): Bump the npm_and_yarn group across 1 directory with 2 updates

paperless-ngx/paperless-ngx #12531

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

dfuchslin/node-bmw-mid #22

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 2 directories with 2 updates

DanielBlomma/cortex #37

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13

kirbah/mcp-typescript-starter #57

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server and openclaw

kleinpanic/memory-spark #20

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

joshuademarco/sopra-fs26-group-08-client #47

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

mad-hin/file-diff-comparer #36

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 32 directories with 2 updates

cloudflare/ai #486

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

devcomfort/ollama-models #1

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 5 comments

deps(deps): bump @hono/node-server from 1.19.12 to 1.19.13

commjoen/generated-game-experiment #459

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13

ava-labs/builders-hub #4062

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /frontend

x0lg0n/Rent-Payment-Splitter #20

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /frontend

roybz/operator-app #37

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /crates/cm-web/frontend

srobinson/context-matters #25

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps-dev): bump @hono/node-server from 1.19.11 to 1.19.13

bintangtimurlangit/newsroom #15

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

michaelsanford/Office-Bingo #94

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): Bump @hono/node-server from 1.19.11 to 1.19.13

spencerbeggs/yaml-effect #52

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13

Hack23/riksdagsmonitor #1596

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13

balmasi/content-queue #5

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Ansvar-Systems/Botswana-law-mcp #21

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13

smith-horn/skillsmith #483

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /plugins/nxtg-forge/servers/governance-mcp

nxtg-ai/forge-plugin #7

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps-dev): bump @hono/node-server from 1.19.11 to 1.19.13

youphenrique/phenrique.me #77

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

cluetec/ngcx-tree #283

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore: bump @hono/node-server from 1.19.11 to 1.19.13 in /frontend

gedrocht/Umboni #42

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps-dev): bump @hono/node-server from 1.19.11 to 1.19.13

spothitch/Spothitch #43

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Ansvar-Systems/Jordanian-law-mcp #17

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /mcps/filesystem-mcp-server

mckinsey/agents-at-scale-marketplace #193

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 4 directories with 5 updates

ds1/pincerpay #107

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13

nestcn/docs.nestjs.cn #458

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore: bump @hono/node-server from 1.19.10 to 1.19.13

DavidRigueira/PuntuacionesJugadoresFrontent #141

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /.agents/mcp-servers/docker-manager-mcp

WetDogNose/hlbw-ai-hub #19

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.12 to 1.19.13

statico/statico.link #8

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Toshi7878/YTyping #347

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.11 to 1.19.13

microsoft/DebugMCP #57

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 3 updates

scorpion7slayer/nxtaicard #17

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.12 to 1.19.13

dev-hato/hato-bot-go #355

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps-dev): bump @hono/node-server from 1.19.11 to 1.19.13

maartentibau/gestructureerde-mededeling #125

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

carson-see/ArkovaCarson #331

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 3 updates

luiscarlosjayk/crud-creator #4

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Package Details

Name:	`@hono/node-server`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@hono/node-server`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 2

MODERATE 2

View All npm Advisories

Package Information

Description:

Node.js Adapter for Hono

Repository:	https://github.com/honojs/node-server
Homepage:	https://github.com/honojs/node-server
Latest Release:	`1.14.4` 12 months ago
Dependent Repos:	34
Dependent Packages:	4
Downloads:	1,870,953
Ranking:	Top 2.2719% by dependent repos Top 1.5021% by downloads Top 4.4218% by dependent pkgs

PR Status

Open 1,956 (47.7%)

Merged 220 (5.4%)

Closed 1,701 (41.5%)

PR Types

Major 106 (2.6%)

Minor 1,404 (34.3%)

Patch 2,367 (57.8%)

@hono/node-server

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server cannot handle "double dots" in URL

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@hono/node-server`