Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39406 Path Traversal Vulnerability in @hono/node-server Prior to 1.19.1... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39406 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces a path traversal flaw in @hono/node-server before version 1.19.1, linking to a vulnerability detail page.
🚨*CVE* CVE-2026-39406 @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be a… https://www.cve.org/CVERecord?id=CVE-2026-39406 ----- Traducción: CVE-2026-39406 @ho… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-39406, noting a path‑handling issue in hono/node‑server that could expose protected static files before version 1.19.13, without mentioning any PoC, exploit, or patch.
CVE-2026-39406 @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be a… https://www.cve.org/CVERecord?id=CVE-2026-39406
Post summary
The tweet announces CVE‑2026‑39406 in @hono/node‑server, describing a path handling flaw in serveStatic that could expose protected static files, and notes that the issue is fixed in version 1.19.13. No exploitation code or active attacks are reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hono | node-server | - | node.js | - |