CVE-2026-39406

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.

• CWE-22

• https://github.com/honojs/node-server/security/advisories/GHSA-92pp-h63x-v22mVendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39399NuGet Gallery is a package repository that powers nuget.org.…9.6
• CVE-2026-3940Insufficient policy enforcement in DevTools in Google Chrome…5.3
• CVE-2026-39400Cronicle is a multi-server task scheduler and runner, with a…6.1
• CVE-2026-39401Cronicle is a multi-server task scheduler and runner, with a…5.4
• CVE-2026-39402lxc is a Linux container runtime. In the setuid helper lxc-u…6.5
• CVE-2026-39405Frappe Learning Management System (LMS) is a learning system…9.4
• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-39409Hono is a Web application framework that provides support fo…5.3
• CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
• CVE-2026-39410Hono is a Web application framework that provides support fo…4.8
• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1