[GHSA-frvp-7c67-39w9] Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) - #8918
Conversation
|
Hi there @yusukebe! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Pull request overview
Adds the Node 18-compatible 1.x security fix to the advisory.
Changes:
- Adds
1.19.15as a fixed version for@hono/node-server.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "1.19.15" |
|
Hi there @yusukebe! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
Updates
Comments
The patch applies to
v2, but it does not affectv1.xversions.v1.xof@hono/node-serveris still widely used. So we added the patch to it and released it as1.19.15.Related: honojs/node-server#381