`@hono/node-server`

Ecosystem:
npm

Package URL:
pkg:npm/@hono/node-server

Total PRs:
4,097 Dependabot PRs

Latest PR:
about 19 hours ago

Unique Repositories:
1,647 repositories

Unique Repos (30 days):
170 repositories

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

GHSA-92pp-h63x-v22m CVE-2026-39406 MODERATE published about 2 months ago • updated 5 days ago

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the req...

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

GHSA-hgxw-5xg3-69jx CVE-2024-32652 HIGH published about 2 years ago • updated about 23 hours ago

### Impact The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those th...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

GHSA-wc8c-qw6v-h7f6 CVE-2026-29087 HIGH published 3 months ago • updated 7 days ago

## Summary When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), incon...

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): Bump @hono/node-server from 1.19.11 to 1.19.13

spencerbeggs/jsonc-effect #25

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13 in the npm_and_yarn group across 0 directory

mannobeats/dockroot #3

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

guirguispierre/memoryvault #18

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.10 to 1.19.13

oslokommune/okr-tracker #1093

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Build(deps-dev): Bump @hono/node-server from 1.19.9 to 1.19.13

AkshayKeerti/cds-engine #7

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): Bump the npm_and_yarn group across 3 directories with 3 updates

yamadashy/repomix #1430

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

karilaa-dev/remote-canvas-mcp #9

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps-dev): Bump @hono/node-server from 1.19.11 to 1.19.13 in /Frontend

TrisNol/Word-Cloud #82

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

TerrifiedBug/vectorflow #162

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): Bump @hono/node-server from 1.19.10 to 1.19.13 in /web

luclacombe/paper-boy-news #29

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.9 to 1.19.13 in /frontend

arthrod/cc-crossbeam #2

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

lamb48/outing-plan #11

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps-dev): bump @hono/node-server from 1.19.9 to 1.19.13

kevinelliott/henry-wiki #9

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13 in /test/mcp

Prequal-Digital/vscode #2577

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

mkluge/logseq-openproject #39

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 1 update

patsea/research-agent #2

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): Bump @hono/node-server from 1.19.12 to 1.19.13 in the npm_and_yarn group across 1 directory

nickcjordan/surfaced-art #536

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 13 directories with 3 updates

Sherlock999xxx/CopilotKit #43

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

shinpr/sub-agents-mcp #76

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Ansvar-Systems/Cypriot-law-mcp #38

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

ktsn-ud/shifta #10

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Ansvar-Systems/uae-law-mcp #23

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

Ansvar-Systems/Luxembourg-law-mcp #23

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /apps/web

ThiagoDelgado-D/EAP-Ecosystem #48

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.12 to 1.19.13 in /mythtv/html/backend

MythTV/mythtv #1344

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

adrianjost/Curriculum-Vitae #2361

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump @hono/node-server from 1.19.11 to 1.19.13

EhTagTranslation/Editor #1352

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

Nymphium/nymphium.github.io #161

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13 in /opencto/opencto-dashboard

Hey-Salad/OpenCTO #133

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 72 comments

Bump the security group across 1 directory with 2 updates

KittyCAD/modeling-app #10885

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /.mcp/server in the npm_and_yarn group across 1 directory

phoenixvc/retort #508

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps-dev): bump @hono/node-server from 1.19.11 to 1.19.13 in /frontend

Prekzursil/momentstudio #517

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 7 comments

chore(deps): bump @hono/node-server from 1.19.9 to 1.19.13

Ansvar-Systems/Latvian-law-mcp #28

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /.agents/mcp-servers/infrastructure-analyzer

WetDogNose/hlbw-ai-hub #18

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

⬆️ Bump the security group across 1 directory with 2 updates

NatoBoram/based.ts #212

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

sto-info-app/sto-info-frontend #811

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

build(deps): bump @hono/node-server from 1.19.10 to 1.19.13 in /.claude/skills

dathere/qsv #3686

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

openMF/web-app #3484

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

SmartBear/smartbear-mcp #413

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore: Bump @hono/node-server from 1.19.11 to 1.19.13 in /frontend

OrcaCD/orca-cd #67

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.10 to 1.19.13

kawamlab/tex-template #32

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates

szabiiii/crawlee #25

1.19.10 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

svierk/ogs-planer-app #150

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

BaiGanio/aperio #85

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

Bump @hono/node-server from 1.19.10 to 1.19.13 in /functions

quadralyst/arccms #17

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): bump @hono/node-server from 1.19.11 to 1.19.13

ng-alain/delon #2015

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

⬆️ Bump @hono/node-server from 1.19.11 to 1.19.13

hikkobay/blog #294

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

build(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in the npm_and_yarn group across 1 directory

adhaghani/jadualkelas #1

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 17 directories with 11 updates

tweetclaw/humancode #9

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Package Details

Name:	`@hono/node-server`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@hono/node-server`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 2

MODERATE 2

View All npm Advisories

Package Information

Description:

Node.js Adapter for Hono

Repository:	https://github.com/honojs/node-server
Homepage:	https://github.com/honojs/node-server
Latest Release:	`1.14.4` 12 months ago
Dependent Repos:	34
Dependent Packages:	4
Downloads:	1,870,953
Ranking:	Top 2.2719% by dependent repos Top 1.5021% by downloads Top 4.4218% by dependent pkgs

PR Status

Open 1,956 (47.7%)

Merged 220 (5.4%)

Closed 1,701 (41.5%)

PR Types

Major 106 (2.6%)

Minor 1,404 (34.3%)

Patch 2,367 (57.8%)

@hono/node-server

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server cannot handle "double dots" in URL

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@hono/node-server`