Update dependency @hono/node-server to v2.1.6 [SECURITY] - #18682

Details

Summary

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Details

Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f
• https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f
• https://github.com/honojs/node-server/releases/tag/v2.1.3
• https://github.com/advisories/GHSA-rmxm-3fg6-px4f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.

Details

A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.

The fix responds with 400 Bad Request to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.

Impact

An unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.

This affects applications served by @hono/node-server behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on /admin/*, runs on the rewritten path and is not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w
• https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313
• https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c
• https://github.com/honojs/node-server/releases/tag/v1.19.18
• https://github.com/honojs/node-server/releases/tag/v2.1.6
• https://github.com/advisories/GHSA-jpvv-r467-5p4w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v2.1.6

Compare Source

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

Compare Source

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in #​404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in #​405

New Contributors

• @​affanmomin made their first contribution in #​404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in #​406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

• ci: add autofix.ci by @​yusukebe in #​392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in #​390
• chore: add better benchmarks by @​BlankParticle in #​391
• docs(readme): update the benchmark by @​yusukebe in #​394
• test(request): accept asynchronous body read errors by @​usualoma in #​403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in #​402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

Compare Source

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in #​389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

Compare Source

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in #​378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in #​383

New Contributors

• @​bilal-azam made their first contribution in #​378
• @​mohamedramadan14 made their first contribution in #​383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in #​377
• perf(request): fast-path QUERY methods by @​usualoma in #​376
• perf(request): fast-path PATCH method by @​yusukebe in #​380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

Compare Source

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @​yusukebe in #​369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.6

Compare Source

What's Changed

• ci: publish to npm from CI with OIDC trusted publishing and bump np by @​yusukebe in #​361
• ci: use npm Staged publishing by @​yusukebe in #​364
• fix: preserve status and statusText when cloning a Response with liveheaders by @​usualoma in #​363

Full Changelog: honojs/node-server@v2.0.5...v2.0.6

v2.0.5

Compare Source

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.