CVE-2026-126344

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

CVE-2026-126343

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

Summary While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates. Details T...

GHSA-QV5M-9PM6-HQP3 @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

Summary While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates. Details T...

CVE-2026-126344

The @hono/node-server library (versions 2.0.0 through 2.1.6) contains a vulnerability where a WebSocket upgrade request-target starting with // causes the WHATWG URL parser to replace the host in c.req.url. This allows an attacker to bypass Origin checks, including those implemented via csrf(), b...

EUVD-2026-124722

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

CVE-2026-126344 @hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

GHSA-JPVV-R467-5P4W @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards...

CVE-2026-126343

The @hono/node-server package (versions 2.0.0 to 2.1.6 ) contains a vulnerability where the WebSocket upgrade handler fails to attach an error listener to the socket before waiting for asynchronous middleware or handler work. If an unauthenticated client resets the TCP connection during this wind...

EUVD-2026-124721

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126343 @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126210

The @hono/node-server library (versions prior to 1.19.18 and 2.0.0 through 2.1.6 ) is vulnerable to a path traversal-style bypass. The server passes a raw request-target containing a backslash () to the WHATWG URL parser, which interprets the backslash as a path separator and resolves dot segment...

CVE-2026-126210 @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

EUVD-2026-124720

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126210: honojs node-server: @hono/node-server allows running the Hono application on Node.js

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126343: honojs node-server: @hono/node-server allows running the Hono application on Node.js

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

PT-2026-146062

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.19.18 @hono/node-server versions 2.0.0 through 2.1.5 Description An authorization bypass occurs when the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser. The...

CVE-2026-126344: honojs node-server: @hono/node-server allows running the Hono application on Node.js

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

PT-2026-146064

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.1.5 Description The WebSocket upgrade path resolves a raw request-target starting with // against a base URL constructed from the Host header. This causes the WHATWG URL parser to treat the...