{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7273760-357d-5d81-80b2-fd1e0924f431", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@hono/node-server", "purl": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1", "version": "1.19.18-tuxcare.1", "pedigree": { "ancestors": [ { "name": "@hono/node-server", "purl": "pkg:npm/%40hono/node-server@1.19.18", "type": "library", "version": "1.19.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23340", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:23d14f84-c7cd-5648-a143-d458481e808c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23340 affects version 1.19.18-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2024-32652", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:1ffb1bb0-0e0b-526f-b21e-0e2f64b2e943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-32652 affects version 1.19.18-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2026-118663", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d43037a7-cb48-5933-b3b0-0f79a6e01c9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-118663 is fixed in version 1.19.18-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2026-126210", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:4f1ac947-7920-5aad-aafe-512da9abbf8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-126210 does not affect version 1.19.18-tuxcare.1 of @hono/node-server. not_affected \u2014 Target @hono/node-server 1.19.18 already contains the upstream fix. Upstream commit 3868998 (\"fix(request): reject raw backslashes in request paths\", Yusuke Wada) adds validateRequestTarget() in src/request.ts, called on both the absolute-form and relative-form paths before new URL(). It throws a RequestError (mapped to 400) when a backslash occurs before any '?'. The fix shipped in the upstrea...", "justification": "code_not_present" } }, { "id": "CVE-2026-126343", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c0cad246-1b23-504f-b623-7975f908a1ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-126343 does not affect version 1.19.18-tuxcare.1 of @hono/node-server. not_affected \u2014 @hono/node-server 1.19.18-tuxcare.1 has no WebSocket/upgrade handling. The vulnerable upgrade handler, which awaits the app before attaching socket error/close listeners, does not exist in this version. The Brief's input (an upgrade request followed by a connection reset) is never received by any target code path.", "justification": "code_not_present" } }, { "id": "CVE-2026-29087", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7ae220f0-b544-5961-b7b9-540eafb12290", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29087 affects version 1.19.18-tuxcare.1 of @hono/node-server." } }, { "id": "CVE-2026-39406", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:617329d0-1fb4-5db6-a0aa-e76853971a6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39406 does not affect version 1.19.18-tuxcare.1 of @hono/node-server. not_affected \u2014 The upstream fix for CVE-2026-39406 (honojs/node-server commit 025c30f) is already in the target. serveStatic rejects any decoded path containing two or more consecutive slashes or backslashes, so `//admin/secret.txt` is never served. The fix was authored upstream (yusuke@kamawada.com) and came in with the upstream release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2026-73565", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:bb183707-5e79-5444-aa07-155ad22cace2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-73565 does not affect version 1.19.18-tuxcare.1 of @hono/node-server. not_affected \u2014 Target @hono/node-server 1.19.18-tuxcare.1 contains no WebSocket support. It has no upgradeWebSocket helper, no upgrade-request handling, no Sec-WebSocket-Key handling and no ws dependency. The leaking map and pending promise from the CVE do not exist here, so the CVE's Input (an upgrade request with a bad handshake key) is never received. Type A1.", "justification": "code_not_present" } }, { "id": "GHSA-frvp-7c67-39w9", "affects": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f71faf05-352c-57b1-aa4f-0846d689d847", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-frvp-7c67-39w9 does not affect version 1.19.18-tuxcare.1 of @hono/node-server. not_affected \u2014 serveStatic in src/serve-static.ts already rejects any decoded backslash, so /admin%5Csecret.txt never reaches the file resolver. The check came from upstream commit 84cb2ee, which is part of the upstream release TuxCare onboarded. The target is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:npm/%40hono/node-server@1.19.18-tuxcare.1" } ] }