Security fixes
This release backports the serveStatic double-decode fixes from the 2.x line to 1.x.
serveStatic decodes the request path a second time, leading to bypass of middleware on static paths
Affects: serveStatic. The request path was decoded again after Hono had already decoded it for routing, so a crafted request could be routed as one path and served as another, and middleware mounted on a static prefix did not run for a file under that prefix. Fixed in 2.1.3 for the 2.x line; this release brings the fix to 1.x. GHSA-rmxm-3fg6-px4f
serveStatic now skips request paths that still contain % after routing. Set allowPercentInPath: true to serve files whose names contain a literal %; see the README for the caveat about route-level access control.
serveStatic with allowPercentInPath decodes the request path a second time, leading to bypass of middleware on static paths
Affects: serveStatic with allowPercentInPath: true. The 1.x line never shipped this option, so no released 1.x version is affected. The backport includes the hardened check from 2.1.7 so that the option arrives in 1.x in its fixed form. GHSA-fj57-4f93-cfw6
The 1.x line receives security fixes only. Install with npm i @hono/node-server@latest-1.
Full Changelog: v1.19.18...v1.19.19