CVE-2026-39406

@hono/node-server versions prior to 1.19.13 contain a path handling inconsistency vulnerability in the serveStatic function that allows attackers to bypass route-based authorization middleware. The vulnerability exists because serveStatic normalizes paths containing repeated slashes (//), while the router fails to match these malformed paths against middleware patterns such as /admin/*. This mismatch enables unauthorized access to protected static files through simple path manipulation. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. While the attack complexity is low, the impact is limited to confidentiality breaches with no integrity or availability concerns. The EPSS score of 0.00018 indicates minimal real-world exploitation likelihood, placing it in a low percentile of CVE risk. There is no evidence of active exploitation, and the vulnerability is not present on any public exploit databases or KEV catalogs. Community attention remains minimal given the low FAUCET risk score of 41.0/100 and inactive status on threat tracking lists. Organizations using @hono/node-server should prioritize patching to version 1.19.13 as a preventive measure, though immediate emergency response is not warranted.