GHSA-wc8c-qw6v-h7f6
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hono/node-server | 0 | 1.19.10 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | langfuse-3 | 0 | 3.160.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.160.0-r1 |
| Chainguard | langfuse-fips-3 | 0 | 3.160.0-r1 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.160.0-r1 |
| Chainguard | librechat | 0 | 0.8.3-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r1 |
| Wolfi | langfuse-3 | 0 | 3.160.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.160.0-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
Related vulnerabilities
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Same vulnerability
- CVE-2026-39406 @hono/node-server allows running the Hono application on Node.js. Also affects @hono/node-server
- GHSA-92pp-h63x-v22m @hono/node-server: Middleware bypass via repeated slashes in serveStatic Also affects @hono/node-server
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-9.1
- GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup Also affects kibana-9.1
- CVE-2026-33940 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33941 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1
- CVE-2026-33939 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-9.1