Skip to content

serveStatic in @hono/node-server serves symlink path instead of resolved file content #4563

@hntrl

Description

@hntrl

When using serveStatic with @hono/node-server, if a requested file in the static directory is a symbolic link, the server returns the content of the symlink (the relative path string) instead of following the link and serving the target file's content.

Steps to Reproduce

  1. Setup a minimal Hono project with @hono/node-server

  2. Create a static directory structure with a symlink:

    mkdir -p static
    echo "<h1>Hello World</h1>" > actual.html
    cd static
    ln -s ../actual.html index.html
  3. Configure serveStatic:

    import { serve } from "@hono/node-server";
    import { serveStatic } from "@hono/node-server/serve-static";
    import { Hono } from "hono";
    
    const app = new Hono();
    
    // Issue occurs regardless of relative or absolute path in 'root'
    app.get("/*", serveStatic({ root: "./static" }));
    
    serve(app);
  4. Request the symlinked file:

    curl http://localhost:3000/index.html

Expected Behavior

The server should resolve the symlink and return the content of actual.html (<h1>Hello World</h1>).

Actual Behavior

(Content-Length matches the length of the path string).


Environment:

Node.js: v22.15.1
hono: ^4.10.6
@hono/node-server: ^1.19.6
OS: macOS (Darwin 24.6.0)

It seems serveStatic might be using a file reading method that does not automatically dereference symlinks (e.g., reading the file descriptor of the link itself) or is explicitly checking file stats but not handling isSymbolicLink() correctly before reading.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions