CVE-2026-126344

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

CVE-2026-126343

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

Summary While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates. Details T...

GHSA-QV5M-9PM6-HQP3 @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

Summary While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates. Details T...

CVE-2026-126344

The @hono/node-server library (versions 2.0.0 through 2.1.6) contains a vulnerability where a WebSocket upgrade request-target starting with // causes the WHATWG URL parser to replace the host in c.req.url. This allows an attacker to bypass Origin checks, including those implemented via csrf(), b...

EUVD-2026-124722

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

CVE-2026-126344 @hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards...

GHSA-JPVV-R467-5P4W @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards...

EUVD-2026-124721

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126343

The @hono/node-server package (versions 2.0.0 to 2.1.6 ) contains a vulnerability where the WebSocket upgrade handler fails to attach an error listener to the socket before waiting for asynchronous middleware or handler work. If an unauthenticated client resets the TCP connection during this wind...

CVE-2026-126343 @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126343

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126210 @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

EUVD-2026-124720

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126210

The @hono/node-server library (versions prior to 1.19.18 and 2.0.0 through 2.1.6 ) is vulnerable to a path traversal-style bypass. The server passes a raw request-target containing a backslash () to the WHATWG URL parser, which interprets the backslash as a path separator and resolves dot segment...

CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126210: honojs node-server: @hono/node-server allows running the Hono application on Node.js

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126343: honojs node-server: @hono/node-server allows running the Hono application on Node.js

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...