CVE-2026-126344

The @hono/node-server library (versions 2.0.0 through 2.1.6) contains a vulnerability where a WebSocket upgrade request-target starting with // causes the WHATWG URL parser to replace the host in c.req.url. This allows an attacker to bypass Origin checks, including those implemented via csrf(), b...