v2.1.8

What's Changed

• fix(request): forward duplex to the native request in #409
• fix(utils): do not chain a promise per chunk while streaming a response in #417
• fix(listener): cancel the response body when the client has already disconnected in #412
• fix(utils): cancel late HTTP/2 response bodies in #419
• fix(listener): do not send a complete response when the body fails during the early read in #420

Full Changelog: v2.1.7...v2.1.8

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

---

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: v2.1.6...v2.1.7

v1.19.19

Security fixes

This release backports the serveStatic double-decode fixes from the 2.x line to 1.x.

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: serveStatic. The request path was decoded again after Hono had already decoded it for routing, so a crafted request could be routed as one path and served as another, and middleware mounted on a static prefix did not run for a file under that prefix. Fixed in 2.1.3 for the 2.x line; this release brings the fix to 1.x. GHSA-rmxm-3fg6-px4f

serveStatic now skips request paths that still contain % after routing. Set allowPercentInPath: true to serve files whose names contain a literal %; see the README for the caveat about route-level access control.

serveStatic with allowPercentInPath decodes the request path a second time, leading to bypass of middleware on static paths

Affects: serveStatic with allowPercentInPath: true. The 1.x line never shipped this option, so no released 1.x version is affected. The backport includes the hardened check from 2.1.7 so that the option arrives in 1.x in its fixed form. GHSA-fj57-4f93-cfw6

---

The 1.x line receives security fixes only. Install with npm i @hono/node-server@latest-1.

Full Changelog: v1.19.18...v1.19.19

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v1.19.18

Security fixes

This release includes a fix for the following security issue:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

---

The same fix, together with two WebSocket fixes, ships in @hono/node-server v2.1.6. Users on 1.x who can upgrade to 2.x are encouraged to do so.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @affanmomin in #404
• fix(serve-static): only serve GET and HEAD requests by @usualoma in #405

New Contributors

• @affanmomin made their first contribution in #404

Full Changelog: v2.1.4...v2.1.5

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @yusukebe in #406

Full Changelog: v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @yusukebe in #392
• fix: type error in early hints and add typecheck to CI by @BlankParticle in #390
• chore: add better benchmarks by @BlankParticle in #391
• docs(readme): update the benchmark by @yusukebe in #394
• test(request): accept asynchronous body read errors by @usualoma in #403
• fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in #402

Full Changelog: v2.1.1...v2.1.2

v2.1.1

What's Changed

• perf: lazily materialize request headers by @BlankParticle in #389

Full Changelog: v2.1.0...v2.1.1