`@hono/node-server`

Ecosystem:
npm

Package URL:
pkg:npm/@hono/node-server

Total PRs:
4,103 Dependabot PRs

Latest PR:
about 2 hours ago

Unique Repositories:
1,649 repositories

Unique Repos (30 days):
165 repositories

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

GHSA-92pp-h63x-v22m CVE-2026-39406 MODERATE published about 2 months ago • updated 5 days ago

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the req...

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

GHSA-hgxw-5xg3-69jx CVE-2024-32652 HIGH published about 2 years ago • updated 1 day ago

### Impact The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those th...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

GHSA-wc8c-qw6v-h7f6 CVE-2026-29087 HIGH published 3 months ago • updated 7 days ago

## Summary When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), incon...

1.19.5 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.7 to 1.19.13 in /mcp_servers/fetch_toolathlon

Klavis-AI/klavis #1479

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13 in /generator-prisma-client/esbuild-cjs

Dustin4444/prisma-examples #172

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13

lilboards/lilboards #3078

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.11 to 1.19.13

aaroncawte/bbndigital #867

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.7 to 1.19.13 in /mcp/edgar-server

arthrod/edgar-change-interpreter #6

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

deps(deps): bump the security-patches group across 3 directories with 3 updates

VeVarunSharma/contoso-vibe-engineering #187

1.19.6 → 1.19.13 Patch PR

Open about 2 months ago 4 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates

danielbodnar/sandbox-agent #8

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Build(deps-dev): Bump @hono/node-server from 1.19.12 to 1.19.13

senatov/web_for_mimi #2

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): Bump @hono/node-server from 1.19.11 to 1.19.13 in /nexus-workflow-app

soonland/nexus-workflow #179

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 5 comments

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates

layertwo/groundwork #134

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.9 to 1.19.13

nekofar/farcaster-frames-template #919

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.9 to 1.19.13

xXKillerNoobYT/Copilot-Orchestration-Extension-COE- #259

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.6 to 1.19.13

wangzhehan84/pt-gen-universal01 #58

1.19.6 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.6 to 1.19.13

WonderMew/pt-gen-universal #46

1.19.6 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.6 to 1.19.13

phyohu/pt-gen-universal #50

1.19.6 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.2 to 1.19.12 in /backend

aaviator/harness #3

1.19.2 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

Bump the all-npm-minor-updates group with 4 updates

mburumaxwell/paklo #2666

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.9 to 1.19.13

happyrq/1 #122

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.9 to 1.19.13

imc700/rsshub202603021752 #128

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump @hono/node-server from 1.19.7 to 1.19.13

yyf19780423/rss-hub #298

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.11 to 1.19.13

grandunifiedtheotries/2222 #51

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

Bump @hono/node-server from 1.19.11 to 1.19.13

mazige1997/rsshub #105

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.9 to 1.19.13

gollumHome/yoursshub #242

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

Bump @hono/node-server from 1.19.9 to 1.19.13

yuseng505/myrss #281

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

Bump @hono/node-server from 1.19.9 to 1.19.13

xudadi/rsshubdiy #128

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.4 to 1.19.13

zhanghailang123/rss-vercel #501

1.19.4 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.7 to 1.19.13

jp0id/RSSHub #1566

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): Bump the minor-and-patch group across 1 directory with 16 updates

mission69b/t2000 #43

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

cristiantx/next-webmcp #11

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates

danielbodnar/sandbox-agent #7

1.19.9 → 1.19.10 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 4 directories with 15 updates

DevGruGold/moltmall #20

1.19.9 → 1.19.12 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.7 to 1.19.12

semba-yui/semba-yui #32

1.19.7 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 5 directories with 18 updates

infrareactive/cal.com #6

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.8 to 1.19.12

canstralian/Sentinel-Copilot #29

1.19.8 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump @hono/node-server from 1.19.7 to 1.19.12

lc-semba-ryuichiro/lc-semba-ryuichiro #34

1.19.7 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm-version-updates group across 1 directory with 15 updates

zitadel/example-auth-hono #45

1.19.10 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.9 to 1.19.12

Jasrags/ShadowMaster #880

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

deps(deps): bump @hono/node-server from 1.19.9 to 1.19.12

Countly/countly-mcp-server #92

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 19 updates

Prekzursil/mcp-funnel #1

1.19.2 → 1.19.10 Patch PR

Open about 2 months ago 2 comments

build(deps): bump the minor-and-patch group across 1 directory with 7 updates

navikt/sokos-utbetalingsportalen #830

1.19.11 → 1.19.12 Patch PR

Closed about 2 months ago 3 comments

build(deps): bump the npm_and_yarn group across 1 directory with 6 updates

jalpp/chessagine-mcp #39

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

build(deps): bump the minor-and-patch group across 1 directory with 8 updates

vana-com/personal-server-ts #71

1.19.11 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.9 to 1.19.12

Wissididom/excel-fill-word #112

1.19.9 → 1.19.12 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump the production-dependencies group across 1 directory with 16 updates

pacphi/mimir #27

1.19.11 → 1.19.12 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the production group with 26 updates

RevealUIStudio/revealui #158

1.19.11 → 1.19.12 Patch PR

Open about 2 months ago 1 comment

chore(deps)(deps): bump the dependencies group with 12 updates

alternatefutures/service-auth #94

1.19.7 → 1.19.12 Patch PR

Open about 2 months ago 5 comments

Bump the npm_and_yarn group across 4 directories with 25 updates

getflip/swirl #1592

1.19.9 → 1.19.12 Patch PR

Closed about 2 months ago 2 comments

deps(deps): bump the dependencies group across 1 directory with 10 updates

a14a-org/claudeskill-manager #29

1.19.11 → 1.19.12 Patch PR

Open about 2 months ago 3 comments

deps(deps): bump @hono/node-server from 1.19.11 to 1.19.12

commjoen/generated-game-experiment #453

1.19.11 → 1.19.12 Patch PR

Closed about 2 months ago 3 comments

Package Details

Name:	`@hono/node-server`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@hono/node-server`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 2

MODERATE 2

View All npm Advisories

Package Information

Description:

Node.js Adapter for Hono

Repository:	https://github.com/honojs/node-server
Homepage:	https://github.com/honojs/node-server
Latest Release:	`1.14.4` 12 months ago
Dependent Repos:	34
Dependent Packages:	4
Downloads:	1,870,953
Ranking:	Top 2.2719% by dependent repos Top 1.5021% by downloads Top 4.4218% by dependent pkgs

PR Status

Open 1,960 (47.8%)

Merged 220 (5.4%)

Closed 1,703 (41.5%)

PR Types

Major 108 (2.6%)

Minor 1,404 (34.2%)

Patch 2,371 (57.8%)

@hono/node-server

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server cannot handle "double dots" in URL

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@hono/node-server`