{
  "@id": "urn:uuid:8369a884-d10b-4a40-9115-15639281fd66",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T21:52:00.055520+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-04T04:05:02.953708+00:00",
      "status_notes": "Vulnerability CVE-2024-23340 does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 CVE-2024-23340 describes path traversal via unresolved `..` sequences in URLs passed to serveStatic. The target (@hono/node-server 1.19.14) is NOT affected because upstream fixes were already present in the release TuxCare onboarded. Two defenses protect against this vulnerability: (1) Request object uses JavaScript's URL API which automatically normalizes paths (src/request.ts:218-219,245), an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-23340"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-23340 describes path traversal via unresolved `..` sequences in URLs passed to serveStatic. The target (@hono/node-server 1.19.14) is NOT affected because upstream fixes were already present in the release TuxCare onboarded. Two defenses protect against this vulnerability: (1) Request object uses JavaScript's URL API which automatically normalizes paths (src/request.ts:218-219,245), an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-04T03:58:00.094435+00:00",
      "status_notes": "Vulnerability CVE-2024-32652 does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 CVE-2024-32652 describes a denial-of-service vulnerability where @hono/node-server crashes when receiving HTTP requests with invalid Host header values (empty strings, slashes, or other malformed values) that cannot be parsed by the URL constructor. The target version 1.19.14 already contains the upstream fix (commit d847e60) that was shipped in v1.10.1. The fix wraps the newRequest() call in a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-32652"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-32652 describes a denial-of-service vulnerability where @hono/node-server crashes when receiving HTTP requests with invalid Host header values (empty strings, slashes, or other malformed values) that cannot be parsed by the URL constructor. The target version 1.19.14 already contains the upstream fix (commit d847e60) that was shipped in v1.10.1. The fix wraps the newRequest() call in a..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-10-29T01:58:39.079103+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.19.14 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-12T21:49:22.806584+00:00",
      "status_notes": "Vulnerability CVE-2026-126210 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-126210"
      },
      "action_statement": "Vulnerability CVE-2026-126210 affects version 1.19.14 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-12T21:52:00.055520+00:00",
      "status_notes": "Vulnerability CVE-2026-126343 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-126343"
      },
      "action_statement": "Vulnerability CVE-2026-126343 affects version 1.19.14 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-02T10:26:00.101937+00:00",
      "status_notes": "Vulnerability CVE-2026-29087 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-29087"
      },
      "action_statement": "Vulnerability CVE-2026-29087 affects version 1.19.14 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-11-04T04:03:00.039139+00:00",
      "status_notes": "Vulnerability CVE-2026-39406 does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 CVE-2026-39406 (path handling inconsistency allowing middleware bypass via repeated slashes) is NOT present in the target. The fix was already included in upstream version 1.19.14 via commit 025c30f by upstream maintainer Yusuke Wada, before TuxCare onboarded this version. The target code at src/serve-static.ts:114 contains the defensive regex pattern that rejects paths with consecutive slashes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39406"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-39406 (path handling inconsistency allowing middleware bypass via repeated slashes) is NOT present in the target. The fix was already included in upstream version 1.19.14 via commit 025c30f by upstream maintainer Yusuke Wada, before TuxCare onboarded this version. The target code at src/serve-static.ts:114 contains the defensive regex pattern that rejects paths with consecutive slashes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-10-28T12:30:55.489332+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 Target version 1.19.14 does not contain WebSocket functionality. The vulnerable component (src/websocket.ts and the upgradeWebSocket helper) does not exist in this version. WebSocket support was introduced in v2.0.0 (commit 35c1dfc), which postdates the target version. Since the target cannot process WebSocket upgrade requests, the memory leak vulnerability in WebSocket handshake handling canno...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 Target version 1.19.14 does not contain WebSocket functionality. The vulnerable component (src/websocket.ts and the upgradeWebSocket helper) does not exist in this version. WebSocket support was introduced in v2.0.0 (commit 35c1dfc), which postdates the target version. Since the target cannot process WebSocket upgrade requests, the memory leak vulnerability in WebSocket handshake handling canno..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-9mqv-5hh9-4cgg does not affect version 1.19.14 of @hono/node-server. not_affected \u2014 Target version 1.19.14 is not affected by GHSA-9mqv-5hh9-4cgg. The WebSocket upgrade functionality containing the memory leak vulnerability does not exist in this version. WebSocket support was introduced later in v2.0.0 (commit 35c1dfc, April 6 2026), after the 1.19.14 release. The vulnerable code path (src/websocket.ts, upgradeWebSocket function, waiterMap data structure) is absent from the t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9mqv-5hh9-4cgg"
      },
      "impact_statement": "not_affected \u2014 Target version 1.19.14 is not affected by GHSA-9mqv-5hh9-4cgg. The WebSocket upgrade functionality containing the memory leak vulnerability does not exist in this version. WebSocket support was introduced later in v2.0.0 (commit 35c1dfc, April 6 2026), after the 1.19.14 release. The vulnerable code path (src/websocket.ts, upgradeWebSocket function, waiterMap data structure) is absent from the t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.14",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.14"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.14 of @hono/node-server.",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "action_statement": "Vulnerability GHSA-frvp-7c67-39w9 affects version 1.19.14 of @hono/node-server."
    }
  ]
}