`@hono/node-server`

Ecosystem:
npm

Package URL:
pkg:npm/@hono/node-server

Total PRs:
4,097 Dependabot PRs

Latest PR:
about 7 hours ago

Unique Repositories:
1,647 repositories

Unique Repos (30 days):
170 repositories

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

GHSA-92pp-h63x-v22m CVE-2026-39406 MODERATE published about 2 months ago • updated 4 days ago

## Summary A path handling inconsistency in `serveStatic` allows protected static files to be accessed by using repeated slashes (`//`) in the req...

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

GHSA-hgxw-5xg3-69jx CVE-2024-32652 HIGH published about 2 years ago • updated about 12 hours ago

### Impact The application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those th...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

GHSA-wc8c-qw6v-h7f6 CVE-2026-29087 HIGH published 3 months ago • updated 7 days ago

## Summary When using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting `/admin/*`), incon...

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 6 directories with 6 updates

PostHog/posthog-js #3366

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

SAP/spartacus #21355

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates

arcade-cabinet/seeds-of-emin #17

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 28 directories with 6 updates

preechapon250/supabase #50

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates

Ethros19/distill #9

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 3 updates

DefHex/Sort-visualizer #69

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 68 updates

middleapi/orpc #1529

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 4 comments

Bump @hono/node-server from 1.19.11 to 1.19.13 in /font-end in the npm_and_yarn group across 1 directory

Nik211885/nik. #2

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 2 updates

billlzzz26/kilocode-plugin #4

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 4 directories with 15 updates

DevGruGold/moltmall #22

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 18 directories with 11 updates

asleekgeek/supabase #768

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 22 comments

Bump the npm_and_yarn group across 6 directories with 3 updates

Hawthorne001/azure-sdk-tools #662

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 9 directories with 7 updates

preechapon250/genkit #87

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 14 directories with 4 updates

danielbodnar/templates #51

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 5 directories with 6 updates

orpaynter/UI-TARS-desktop #62

1.19.3 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 14 directories with 5 updates

Sherlock999xxx/CopilotKit #46

1.19.7 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 3 directories with 10 updates

danielbodnar/sandbox-agent #10

1.19.9 → 1.19.13 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates

Moltenship/poker #18

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 16 updates

valle808/Humanese #62

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

build(deps): bump the npm_and_yarn group across 17 directories with 13 updates

tweetclaw/humancode #11

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 4 directories with 14 updates

haardikppatel/tpro #7

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 2 directories with 3 updates

Endsett/Echocoder #8

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 4 directories with 7 updates

ScorpionBytes/vscode #47

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 2 directories with 5 updates

BenMakesGames/PoppySeedPets #240

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13

RevealUIStudio/revealui #195

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

Koraji95-coder/Suite #142

1.19.10 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 9 updates

olchar/CyberProbe-Public #1

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.9 to 1.19.13

edicarloslds/businessmap-mcp #13

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

serhiikim/ticket-refinement-agent #3

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 14 directories with 3 updates

supabase/supabase #44653

1.19.10 → 1.19.13 Patch PR

Open about 2 months ago 3 comments

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates

jfilter/timetiles #110

1.19.11 → 1.19.12 Patch PR

Open about 2 months ago 1 comment

deps: bump @hono/node-server from 1.19.12 to 1.19.13

diegosouzapw/OmniRoute #1067

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 3 directories with 15 updates

sentry-demos/empower #1414

1.19.9 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

build(deps): bump @hono/node-server from 1.19.12 to 1.19.13 in /packages/backend

nihalgonsalves/expenses #360

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

build(deps): bump @hono/node-server from 1.19.12 to 1.19.13

dungeon-studio/genshin.dungeon.studio #658

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps)(deps): bump @hono/node-server from 1.19.12 to 1.19.13

Ansvar-Systems/STRIDE-mcp #50

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 3 comments

Bump @hono/node-server from 1.19.12 to 1.19.13

neill-k/generic-corp #250

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

build(deps): bump @hono/node-server from 1.19.12 to 1.19.13 in /examples/get-time/src/get_time/views

mplemay/gdansk #93

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

Bump @hono/node-server from 1.19.12 to 1.19.13 in /frontend

kollinnbenv/simbolize #33

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.12 to 1.19.13

cretara/headache-calendar #2

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps)(deps): bump @hono/node-server from 1.19.12 to 1.19.13

unisone/meridian-freight-website #50

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

gottasellemall69/card-test #267

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Bump @hono/node-server from 1.19.11 to 1.19.13

charithmu/leasing_calculator #5

1.19.11 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.12 to 1.19.13

UWL-CODERS/website #331

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump @hono/node-server from 1.19.12 to 1.19.14

macrat/remote-kintone-mcp-server #25

1.19.12 → 1.19.14 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

stellar/stellar-mpp-sdk #43

1.19.11 → 1.19.13 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

palpalani/agentkit-bayengage #186

1.19.12 → 1.19.13 Patch PR

Closed about 2 months ago 1 comment

deps: bump @hono/node-server from 1.19.12 to 1.19.13

product-on-purpose/pm-skills-mcp #44

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

KeeperHub/keeperhub #784

1.19.12 → 1.19.13 Patch PR

Open about 2 months ago 1 comment

Package Details

Name:	`@hono/node-server`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@hono/node-server`
JSON API:	View JSON

Security Advisories

4

Active advisories

HIGH 2

MODERATE 2

View All npm Advisories

Package Information

Description:

Node.js Adapter for Hono

Repository:	https://github.com/honojs/node-server
Homepage:	https://github.com/honojs/node-server
Latest Release:	`1.14.4` 12 months ago
Dependent Repos:	34
Dependent Packages:	4
Downloads:	1,870,953
Ranking:	Top 2.2719% by dependent repos Top 1.5021% by downloads Top 4.4218% by dependent pkgs

PR Status

Open 1,956 (47.7%)

Merged 220 (5.4%)

Closed 1,701 (41.5%)

PR Types

Major 106 (2.6%)

Minor 1,404 (34.3%)

Patch 2,367 (57.8%)

@hono/node-server

Security Advisories

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

@hono/node-server cannot handle "double dots" in URL

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@hono/node-server`