CVE-2026-39406

What it actually does

A path normalization inconsistency in serveStatic allows requests containing repeated slashes (//) to bypass route-based authorization middleware, resulting in unauthorized access to protected static files.

Why it matters to the business

Attackers may obtain sensitive static files intended to be restricted behind authentication or authorization, leading to potential data exposure and compliance risks.

How an attack unfolds

An attacker identifies routes using middleware such as /admin/* for protection, then issues HTTP requests to static files with repeated slashes in the path; the middleware fails to match while serveStatic normalizes and serves the content.

How to fix it

Upgrade @hono/node-server to version 1.19.13 or later.

How to confirm the fix worked

Confirm the package version is 1.19.13 or newer and test that double-slash requests to protected static paths now trigger middleware authorization.

Typical attack path

1. Map application routes that protect static files with middleware
2. Craft requests inserting repeated slashes into protected paths
3. Issue the request and confirm file contents are returned without authorization

How to detect it

Review web access logs for successful responses to static file paths containing repeated slashes, particularly paths that should have been blocked by middleware.

• GET requests with '//' in URL paths to static files
• Access logs showing 200 responses for protected paths containing double slashes

What your security team should do

• Upgrade @hono/node-server to 1.19.13 immediately
• Audit all static file middleware configurations for similar path-handling assumptions
• Add defense-in-depth access controls for any sensitive static content