{
  "@id": "urn:uuid:1c5469ed-8e82-490c-9e19-95c0cb766e60",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T10:35:09.793539+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-02T10:58:44.985896+00:00",
      "status_notes": "Vulnerability CVE-2024-23340 affects version 1.19.18 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-23340"
      },
      "action_statement": "Vulnerability CVE-2024-23340 affects version 1.19.18 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-02T10:58:44.985896+00:00",
      "status_notes": "Vulnerability CVE-2024-32652 affects version 1.19.18 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2024-32652"
      },
      "action_statement": "Vulnerability CVE-2024-32652 affects version 1.19.18 of @hono/node-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-13T19:15:00.109836+00:00",
      "status_notes": "Vulnerability CVE-2026-118663 affects version 1.19.18 of @hono/node-server, and is fixed in 1.19.18-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-118663"
      },
      "action_statement": "Vulnerability CVE-2026-118663 affects version 1.19.18 of @hono/node-server, and is fixed in 1.19.18-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-12T21:51:50.741058+00:00",
      "status_notes": "Vulnerability CVE-2026-126210 does not affect version 1.19.18 of @hono/node-server. not_affected \u2014 Target @hono/node-server 1.19.18 already contains the upstream fix. Upstream commit 3868998 (\"fix(request): reject raw backslashes in request paths\", Yusuke Wada) adds validateRequestTarget() in src/request.ts, called on both the absolute-form and relative-form paths before new URL(). It throws a RequestError (mapped to 400) when a backslash occurs before any '?'. The fix shipped in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-126210"
      },
      "impact_statement": "not_affected \u2014 Target @hono/node-server 1.19.18 already contains the upstream fix. Upstream commit 3868998 (\"fix(request): reject raw backslashes in request paths\", Yusuke Wada) adds validateRequestTarget() in src/request.ts, called on both the absolute-form and relative-form paths before new URL(). It throws a RequestError (mapped to 400) when a backslash occurs before any '?'. The fix shipped in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-14T09:31:52.437184+00:00",
      "status_notes": "Vulnerability CVE-2026-126343 does not affect version 1.19.18 of @hono/node-server. not_affected \u2014 @hono/node-server 1.19.18-tuxcare.1 has no WebSocket/upgrade handling. The vulnerable upgrade handler, which awaits the app before attaching socket error/close listeners, does not exist in this version. The Brief's input (an upgrade request followed by a connection reset) is never received by any target code path.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-126343"
      },
      "impact_statement": "not_affected \u2014 @hono/node-server 1.19.18-tuxcare.1 has no WebSocket/upgrade handling. The vulnerable upgrade handler, which awaits the app before attaching socket error/close listeners, does not exist in this version. The Brief's input (an upgrade request followed by a connection reset) is never received by any target code path."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-02T10:58:44.985896+00:00",
      "status_notes": "Vulnerability CVE-2026-29087 affects version 1.19.18 of @hono/node-server.",
      "vulnerability": {
        "name": "CVE-2026-29087"
      },
      "action_statement": "Vulnerability CVE-2026-29087 affects version 1.19.18 of @hono/node-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-13T22:54:36.916695+00:00",
      "status_notes": "Vulnerability CVE-2026-39406 does not affect version 1.19.18 of @hono/node-server. not_affected \u2014 The upstream fix for CVE-2026-39406 (honojs/node-server commit 025c30f) is already in the target. serveStatic rejects any decoded path containing two or more consecutive slashes or backslashes, so `//admin/secret.txt` is never served. The fix was authored upstream (yusuke@kamawada.com) and came in with the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39406"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2026-39406 (honojs/node-server commit 025c30f) is already in the target. serveStatic rejects any decoded path containing two or more consecutive slashes or backslashes, so `//admin/secret.txt` is never served. The fix was authored upstream (yusuke@kamawada.com) and came in with the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-14T10:35:09.793539+00:00",
      "status_notes": "Vulnerability CVE-2026-73565 does not affect version 1.19.18 of @hono/node-server. not_affected \u2014 Target @hono/node-server 1.19.18-tuxcare.1 contains no WebSocket support. It has no upgradeWebSocket helper, no upgrade-request handling, no Sec-WebSocket-Key handling and no ws dependency. The leaking map and pending promise from the CVE do not exist here, so the CVE's Input (an upgrade request with a bad handshake key) is never received. Type A1.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73565"
      },
      "impact_statement": "not_affected \u2014 Target @hono/node-server 1.19.18-tuxcare.1 contains no WebSocket support. It has no upgradeWebSocket helper, no upgrade-request handling, no Sec-WebSocket-Key handling and no ws dependency. The leaking map and pending promise from the CVE do not exist here, so the CVE's Input (an upgrade request with a bad handshake key) is never received. Type A1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40hono/node-server@1.19.18",
          "identifiers": {
            "purl": "pkg:npm/%40hono/node-server@1.19.18"
          }
        }
      ],
      "timestamp": "2026-11-13T23:08:57.020439+00:00",
      "status_notes": "Vulnerability GHSA-frvp-7c67-39w9 does not affect version 1.19.18 of @hono/node-server. not_affected \u2014 serveStatic in src/serve-static.ts already rejects any decoded backslash, so /admin%5Csecret.txt never reaches the file resolver. The check came from upstream commit 84cb2ee, which is part of the upstream release TuxCare onboarded. The target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-frvp-7c67-39w9"
      },
      "impact_statement": "not_affected \u2014 serveStatic in src/serve-static.ts already rejects any decoded backslash, so /admin%5Csecret.txt never reaches the file resolver. The check came from upstream commit 84cb2ee, which is part of the upstream release TuxCare onboarded. The target is not affected."
    }
  ]
}