fix(deps): update dependency @hono/node-server to ^1.19.14 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	^1.13.0 → ^1.19.14
@hono/node-server	^1.8.0 → ^1.19.14

---

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C)

GHSA-frvp-7c67-39w9

More information

Details

The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C).

Summary

On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.

Details

The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/* does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree.

This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.

Impact

An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9
• https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf
• https://github.com/honojs/node-server/releases/tag/v2.0.5
• https://github.com/advisories/GHSA-frvp-7c67-39w9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server)

v1.19.14

Compare Source

What's Changed

• fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @​usualoma in #​340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Compare Source

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

Compare Source

What's Changed

• chore: ignore claude setting by @​yusukebe in #​314
• fix: request draining for early 413 responses by @​usualoma in #​329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

Compare Source

What's Changed

• fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @​usualoma in #​309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Compare Source

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

Compare Source

What's Changed

• fix(globals): Stop overwriting global.fetch by @​usualoma in #​295

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

Compare Source

What's Changed

• docs: add guide for listening to UNIX domain socket by @​TransparentLC in #​292
• fix(serve-static): Use Readable.toWeb in serveStatic by @​otya128 in #​293

New Contributors

• @​TransparentLC made their first contribution in #​292
• @​otya128 made their first contribution in #​293

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

Compare Source

What's Changed

• fix: Fix for hono issue 4563 - incorrect content-length after following symlink by @​tshmieldev in #​290
• chore: add configVersion to bun.lock by @​yusukebe in #​291

New Contributors

• @​tshmieldev made their first contribution in #​290

Full Changelog: honojs/node-server@v1.19.6...v1.19.7

v1.19.6

Compare Source

What's Changed

• fix(serve-static): fix onFound timing by @​usualoma in #​286

Full Changelog: honojs/node-server@v1.19.5...v1.19.6

v1.19.5

Compare Source

What's Changed

• fix: cancel a readable stream if a writable stream is closed before a readable stream is closed. by @​usualoma in #​280

Full Changelog: honojs/node-server@v1.19.4...v1.19.5

v1.19.4

Compare Source

What's Changed

• fix(serve-static): Add error handling in createStreamBody by @​thongdoan in #​278

New Contributors

• @​thongdoan made their first contribution in #​278

Full Changelog: honojs/node-server@v1.19.3...v1.19.4

v1.19.3

Compare Source

What's Changed

• fix: Refactor promise check for response handling by @​kay-is in #​277

New Contributors

• @​kay-is made their first contribution in #​277

Full Changelog: honojs/node-server@v1.19.2...v1.19.3

v1.19.2

Compare Source

What's Changed

• fix: better handle range parse to avoid NaN error by @​zwpaper in #​276

New Contributors

• @​zwpaper made their first contribution in #​276

Full Changelog: honojs/node-server@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

• fix: Keep lightweight request even if accessing method, url or headers by @​usualoma in #​274
• chore: add packageManager field in package.json by @​yusukebe in #​275

Full Changelog: honojs/node-server@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• feat: add log when directory does not exists by @​Its-Just-Nans in #​273

New Contributors

• @​Its-Just-Nans made their first contribution in #​273

Full Changelog: honojs/node-server@v1.18.2...v1.19.0

v1.18.2

Compare Source

What's Changed

• fix: Skip content-length assignment when transfer-encoding is chunked. by @​usualoma in #​271

Full Changelog: honojs/node-server@v1.18.1...v1.18.2

v1.18.1

Compare Source

What's Changed

• fix(listener): Limit retries to a maximum of three. by @​usualoma in #​267

Full Changelog: honojs/node-server@v1.18.0...v1.18.1

v1.18.0

Compare Source

What's Changed

• feat: always respond res.body by @​usualoma in #​262
• ci: add Node.js v24 for CI by @​yusukebe in #​263
• fix(listener): In Node.js v24, some response bodies are not read to the end until the next task queue. by @​usualoma in #​265

Full Changelog: honojs/node-server@v1.17.1...v1.18.0

v1.17.1

Compare Source

What's Changed

• fix: handle client disconnection without canceling stream by @​yusukebe in #​258
• fix: improve serve-static function by @​usualoma in #​261

Full Changelog: honojs/node-server@v1.17.0...v1.17.1

v1.17.0

Compare Source

What's Changed

• docs: separate description of autoCleanupIncoming by @​usualoma in #​255
• chore: rename server_socket.test.ts to server-socket.test.ts by @​yusukebe in #​256
• feat(serve-static): support absolute path by @​yusukebe in #​257

Full Changelog: honojs/node-server@v1.16.0...v1.17.0

v1.16.0

Compare Source

What's Changed

• feat: Clean up the incoming object if the request is not completely finished. by @​usualoma in #​252

Full Changelog: honojs/node-server@v1.15.0...v1.16.0

v1.15.0

Compare Source

What's Changed

• feat(serve-static): pass context to rewriteRequestPath by @​yusukebe in #​247

Full Changelog: honojs/node-server@v1.14.4...v1.15.0

v1.14.4

Compare Source

What's Changed

• fix: flush headers before sending data via readable stream by @​usualoma in #​245

Full Changelog: honojs/node-server@v1.14.3...v1.14.4

v1.14.3

Compare Source

What's Changed

• fix: set RequestError name properly by @​yusukebe in #​243

Full Changelog: honojs/node-server@v1.14.2...v1.14.3

v1.14.2

Compare Source

What's Changed

• perf: keep using the lightweight Response object when retrieving headers, status, and ok, and then drop the getInternalBody function. by @​usualoma in #​242

Full Changelog: honojs/node-server@v1.14.1...v1.14.2

v1.14.1

Compare Source

What's Changed

• fix: Handle Response Errors Correctly by @​jpulec in #​236

New Contributors

• @​jpulec made their first contribution in #​236

Full Changelog: honojs/node-server@v1.14.0...v1.14.1

v1.14.0

Compare Source

What's Changed

• chore: use Bun as a package manager by @​yusukebe in #​224
• fix: #​230 use node:fs specifier prefix vs. fs import by @​firxworx in #​231
• feat: accept absolute-form URI for request-target by @​usualoma in #​232
• fix: fix the return type of responseViaCache by @​yusukebe in #​234

New Contributors

• @​firxworx made their first contribution in #​231

Full Changelog: honojs/node-server@v1.13.8...v1.14.0

v1.13.8

Compare Source

What's Changed

• fix: export ServerOptions type by @​aryasaatvik in #​222
• fix: re-read request body from incoming.rawBody if available by @​usualoma in #​223
• fix: Avoid error if connection is aborted before internal request object is created by @​usualoma in #​221

New Contributors

• @​aryasaatvik made their first contribution in #​222

Full Changelog: honojs/node-server@v1.13.7...v1.13.8

v1.13.7

Compare Source

What's Changed

• fix: detection of client premature close by @​Tomas2D in #​218

New Contributors

• @​Tomas2D made their first contribution in #​218

Full Changelog: honojs/node-server@v1.13.6...v1.13.7

v1.13.6

Compare Source

What's Changed

• fix: conninfo returns server IP by @​nakasyou in #​216

Full Changelog: honojs/node-server@v1.13.5...v1.13.6

v1.13.5

Compare Source

What's Changed

• fix(utils): accept HeadersInit, null, undefined in buildOutgoingHttpHeaders by @​usualoma in #​212

Full Changelog: honojs/node-server@v1.13.4...v1.13.5

v1.13.4

Compare Source

What's Changed

• fix: TypeError: headers is not iterable by @​mjad218 in #​210

New Contributors

• @​mjad218 made their first contribution in #​210

Full Changelog: honojs/node-server@v1.13.3...v1.13.4

v1.13.3

Compare Source

What's Changed

• fix(serve-static): add error handler for decoding uri components by @​alumowa in #​208

New Contributors

• @​alumowa made their first contribution in #​208

Full Changelog: honojs/node-server@v1.13.2...v1.13.3

v1.13.2

Compare Source

What's Changed

• fix(serve): support ipv6 by default by @​sinasab in #​206

New Contributors

• @​sinasab made their first contribution in #​206

Full Changelog: honojs/node-server@v1.13.1...v1.13.2

v1.13.1

Compare Source

What's Changed

• fix(serve-static): use application/octet-stream if the mime type is not detected by @​usualoma in #​201

Full Changelog: honojs/node-server@v1.13.0...v1.13.1

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.