{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1965498-be9b-5071-b415-fa72a13f4ea1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@hono/node-server", "purl": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1", "version": "1.19.17-tuxcare.1", "pedigree": { "ancestors": [ { "name": "@hono/node-server", "purl": "pkg:npm/%40hono/node-server@1.19.17", "type": "library", "version": "1.19.17" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23340", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:0f907bee-3958-51db-989a-1c00ece818e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23340 does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 CVE-2024-23340 describes a path traversal vulnerability in Hono's custom Request object where URLs containing `..` (double dots) were not normalized, allowing attackers to access files outside the intended directory when using serveStatic. The vulnerability was present from v1.3.0 and fixed in upstream v1.4.1 (commit dd9b9a9, January 2024) by using Node.js's URL constructor which automatically ...", "justification": "code_not_present" } }, { "id": "CVE-2024-32652", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:329996b1-b0d6-56ce-9dab-901251ccb673", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-32652 does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 CVE-2024-32652 affects @hono/node-server versions before 1.11.0. The target version 1.19.17-tuxcare.1 includes the upstream fix (commit 306d98f) that was authored by Taku Amano and shipped in v1.11.0 (April 2024). The fix adds exception handling in src/listener.ts that catches invalid Host header parsing errors and returns HTTP 400 instead of crashing. This fix was already present in the upstre...", "justification": "code_not_present" } }, { "id": "CVE-2026-118663", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:bc4d8192-f6fc-5d34-8276-a0297c7011b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-118663 is fixed in version 1.19.17-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2026-29087", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:75658327-f0dc-5049-bd8b-bc3ee085b7f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29087 affects version 1.19.17-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2026-39406", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:da5a5b34-a183-515b-9a87-649e7cf94558", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39406 does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 CVE-2026-39406 is NOT affecting version 1.19.17-tuxcare.1. The vulnerability (path handling inconsistency allowing repeated slashes to bypass route-based middleware) was already fixed by the upstream vendor in commit 025c30f (April 2026) as part of version 1.19.13. The fix adds `[\\/\\\\]{2,}` to the path validation regex in serve-static.ts to reject paths with repeated slashes. This upstream fix ...", "justification": "code_not_present" } }, { "id": "CVE-2026-73565", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:d035ba2b-eeea-508a-86a3-a7b709d010b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 The target version 1.19.17 does not contain the vulnerable WebSocket functionality. The websocket feature (src/websocket.ts, upgradeWebSocket) was introduced in v2.0.0-rc.2 on the v2.x branch, while this target is on the v1.x maintenance branch. Exhaustive searches confirm zero websocket-related code exists in the repository at this version.", "justification": "code_not_present" } }, { "id": "GHSA-9mqv-5hh9-4cgg", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:f31ad71d-fd54-5b35-8968-0a1070b0ad1e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 The target version 1.19.17 does not contain WebSocket functionality. The vulnerable code in src/websocket.ts and the upgradeWebSocket helper were introduced in version 2.0.0-rc.2 (commit 35c1dfc), which is after this version. The vulnerability fix was applied in v2.0.10 (commit 3a21938). Since the entire WebSocket feature doesn't exist in 1.19.17, the memory leak vulnerability cannot occur.", "justification": "code_not_present" } }, { "id": "GHSA-frvp-7c67-39w9", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ], "bom-ref": "urn:uuid:216a85c9-0ca6-514f-ba8c-1b7d5cd1b8fe", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-frvp-7c67-39w9 does not affect version 1.19.17-tuxcare.1 of @hono/node-server. not_affected \u2014 The target @hono/node-server version 1.19.17 is NOT AFFECTED by GHSA-frvp-7c67-39w9 (Windows path traversal via encoded backslash). The vulnerability pattern is not present because the upstream vendor (Yusuke Wada) already applied the fix in commit 84cb2ee on July 24, 2026, before TuxCare onboarded the package on August 21, 2026. The current code at src/serve-static.ts:114 contains the backslas...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/%40hono/node-server@1.19.17-tuxcare.1" } ] }