`@hono/node-server`

Ecosystem:
npm

Package URL:
pkg:npm/@hono/node-server

Total PRs:
4,104 Dependabot PRs

Latest PR:
about 13 hours ago

Unique Repositories:
1,649 repositories

Unique Repos (30 days):
166 repositories

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

GHSA-92pp-h63x-v22m CVE-2026-39406 MODERATE published about 2 months ago • updated 6 days ago

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the req...

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

GHSA-hgxw-5xg3-69jx CVE-2024-32652 HIGH published about 2 years ago • updated 2 days ago

### Impact The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those th...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

GHSA-wc8c-qw6v-h7f6 CVE-2026-29087 HIGH published 3 months ago • updated 8 days ago

## Summary When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), incon...

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 8 updates

aloewright/zettl #6

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the production group across 1 directory with 34 updates

cogitator-ai/Cogitator-AI #71

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

build(deps-dev): bump the development-dependencies group across 1 directory with 22 updates

declanlscott/fodder #360

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

Bump @hono/node-server from 1.19.9 to 1.19.11 in /tools/gcloud-console-server

khill1269/servalsheets-v2 #17

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

build(deps): bump the npm_and_yarn group across 2 directories with 11 updates

sentry-demos/empower #1376

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the test-versions group across 1 directory with 117 updates

DataDog/dd-trace-js #7835

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 4 comments

chore(deps-dev): bump @hono/node-server from 1.19.9 to 1.19.11 in /src/zettel-web-ui

aloewright/zettl #4

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 2 directories with 17 updates

AKJUS/ag-grid #424

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 3 directories with 4 updates

abdussamadraeen/microservices-ecommerce #3

1.19.9 → 1.19.10 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 6 directories with 4 updates

astack-tech/astack #26

1.19.6 → 1.19.10 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates

orpaynter/UI-TARS-desktop #39

1.19.3 → 1.19.10 Patch PR

Open 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 10 directories with 11 updates

stackconsult/RE-Engine #25

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 3 directories with 5 updates

HYOSUNG-ITX-AI-Business-Department/litellm #33

1.19.6 → 1.19.10 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates

rsl37/GLX_Systems_Network #839

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.7 to 1.19.11 in /webapp/frontend

Starosdev/scrutiny #387

1.19.7 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates

astack-tech/astack #25

1.19.6 → 1.19.10 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates

danielbodnar/sandbox-agent #3

1.19.9 → 1.19.10 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the production group across 1 directory with 46 updates

howarewoo/woo-stack #125

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 5 updates

kubb-labs/kubb #2833

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 8 updates

DollhouseMCP/mcp-server #1610

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 6 comments

build(deps): bump the npm_and_yarn group across 5 directories with 28 updates

SocioProphet/socioprophet #241

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 9 directories with 8 updates

preechapon250/genkit #54

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 11 directories with 15 updates

cezary13k/continue #2

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 2 directories with 11 updates

sentry-demos/empower #1372

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 5 updates

kubb-labs/kubb #2811

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 3 updates

AndyLiner13/vscode-devtools-mcp #34

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 4 directories with 7 updates

abdurrazzak7395-rgb/workflow #11

1.19.5 → 1.19.10 Patch PR

Closed 2 months ago 1 comment

Bump @hono/node-server from 1.19.9 to 1.19.11 in /test/mcp

yeathtit/vscode #4

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

BetaBots-LLC/nextjs-supa-template #4

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 2 directories with 8 updates

danielbodnar/mcp #1

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 6 directories with 12 updates

tldraw/tldraw #8268

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 6 directories with 12 updates

tldraw/tldraw #8262

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 4 comments

build(deps): bump the npm_and_yarn group across 10 directories with 7 updates

neynarxyz/farcaster-examples #102

1.19.6 → 1.19.11 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the test-versions group across 1 directory with 115 updates

DataDog/dd-trace-js #7807

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 2 comments

build(deps): bump the patch-and-minor-dependencies group across 1 directory with 50 updates

nl-design-system/theme-wizard #616

1.19.7 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

build(deps): bump @hono/node-server from 1.19.9 to 1.19.10

MechanicalRock/s3-malware-protection-demo #1

1.19.9 → 1.19.10 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the production group across 1 directory with 32 updates

cogitator-ai/Cogitator-AI #69

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 5 updates

groupthinking/EventRelay #70

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates

sirbastiano/pystamps #1

1.19.7 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.8 to 1.19.11 in /scripts/mcp

jasonmichaelbell78-creator/sonash-v0 #440

1.19.8 → 1.19.11 Patch PR

Closed 2 months ago 5 comments

chore(deps): bump the workspace-dependencies group across 1 directory with 23 updates

hb-dragons/dragons-hub #20

1.19.10 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

build(deps): bump the npm-dependencies group across 1 directory with 14 updates

acharyaPawan/url-shortener #8

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

the-snesler/vibe-check #4

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates

khill1269/servalsheets #26

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 3 comments

chore(deps): bump the patch-updates group across 1 directory with 7 updates

objectstack-ai/objectos #309

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 3 comments

chore(deps): bump the test-versions group across 1 directory with 116 updates

DataDog/dd-trace-js #7782

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 4 comments

chore(deps): bump the all-minor-patch group across 1 directory with 27 updates

WuMingDao/zenith-image-generator #86

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 4 comments

deps: Bump the minor-and-patch group across 1 directory with 8 updates

vinaes/md-succ-ai #8

1.19.9 → 1.19.11 Patch PR

Open 2 months ago 1 comment

build(deps): bump @hono/node-server from 1.19.9 to 1.19.11 in /ui

Nodoubtz-Record-Label/github-mcp-server #5

1.19.9 → 1.19.11 Patch PR

Closed 2 months ago 1 comment

Package Details

Name:	`@hono/node-server`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@hono/node-server`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 2

MODERATE 2

View All npm Advisories

Package Information

Description:

Node.js Adapter for Hono

Repository:	https://github.com/honojs/node-server
Homepage:	https://github.com/honojs/node-server
Latest Release:	`1.14.4` 12 months ago
Dependent Repos:	34
Dependent Packages:	4
Downloads:	1,870,953
Ranking:	Top 2.2719% by dependent repos Top 1.5021% by downloads Top 4.4218% by dependent pkgs

PR Status

Open 1,960 (47.8%)

Merged 220 (5.4%)

Closed 1,704 (41.5%)

PR Types

Major 108 (2.6%)

Minor 1,404 (34.2%)

Patch 2,372 (57.8%)

@hono/node-server

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server cannot handle "double dots" in URL

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@hono/node-server`