{"id":"GHSA-frvp-7c67-39w9","title":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","summary":"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)","severity":"medium","cvss":5.9,"cwe":["CWE-22"],"vendor":"hono","product":"@hono/node-server","ecosystem":"npm","affected":["@hono/node-server < 2.0.5"],"patched":["@hono/node-server 2.0.5"],"published":"2026-07-21","updated":"2026-07-21","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-frvp-7c67-39w9","references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9"},{"url":"https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf"},{"url":"https://github.com/honojs/node-server/releases/tag/v2.0.5"},{"url":"https://github.com/advisories/GHSA-frvp-7c67-39w9"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-21T18:53:06.739Z","slug":"GHSA-frvp-7c67-39w9","body":"## Overview\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (`..`) remains blocked.\n\n### Details\n\nThe router splits paths only on `/`, so `/admin%5Csecret.txt` is one segment and middleware on `/admin/*` does not run. The `serve-static` guard rejects `.`/`..` and consecutive separators but lets a lone `\\` through; on Windows the file resolver re-splits it into the protected subtree.\n\nThis affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.\n\n### Impact\n\nAn unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.\n\n## Affected packages\n\n- `@hono/node-server < 2.0.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@hono/node-server 2.0.5`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}