The @hono/node-server library is vulnerable to an unauthenticated authorization bypass that exposes restricted static files to unauthorized users.

This is an authorization bypass vulnerability (CWE-863) where inconsistent URL decoding of encoded slashes (%2F) causes a mismatch between route-based middleware matching and static file resolution. An unauthenticated attacker can craft specific paths to bypass security checks intended to protect sensitive directories.

The vulnerability enables unauthorized access to sensitive static assets, which may contain configuration files, private data, or internal administrative resources. Given the CVSS score of 7.5, this represents a high-severity risk that could lead to significant data exposure if protected files are successfully retrieved by external parties.

Immediate Action: Update the @hono/node-server package to version 1.19.10 or later immediately.

Proactive Monitoring: Review access logs for suspicious URL patterns containing encoded characters like %2F, particularly when targeting paths that should be protected by middleware.

Compensating Controls: Implement strict path normalization at the reverse proxy or Web Application Firewall (WAF) layer to block requests containing encoded directory traversal sequences before they reach the Node.js application.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to data confidentiality by allowing attackers to circumvent access controls. Administrators should prioritize updating the @hono/node-server dependency to the patched version, 1.19.10, as soon as possible to prevent potential unauthorized access to protected static content.