{"cve":"CVE-2024-23340","nvd":{"published":"2024-01-22T23:15:08.637","modified":"2026-06-17T07:12:37.777","status":"Modified","description":"@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called \"double dots\", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-22"],"references":["https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45","https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402","https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359","https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45","https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402"],"products":["hono:node-server"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-23340","score":0.00722,"percentile":0.54007,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rjq5-w47x-x359","url":"https://osv.dev/vulnerability/GHSA-rjq5-w47x-x359","summary":"@hono/node-server cannot handle \"double dots\" in URL","modified":"2026-09-10T03:50:05.180372542Z","packages":[{"ecosystem":"npm","name":"@hono/node-server","purl":"pkg:npm/%40hono/node-server","ranges":[">=1.3.0 <1.4.1"],"fixed":["1.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}