CVE-2026-126210

Received Received - Intake

Path Traversal in Hono Node Server

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse proxy, load balancer, or web application firewall that preserves the backslash and applies path-based rules to the original request can therefore permit a request that the application normalizes to a blocked route. This lets an unauthenticated client reach route content that the upstream component was intended to deny, while Hono application access controls are unaffected because they operate on the normalized path. This issue is fixed in versions 1.19.18 and 2.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126210

EUVD

EUVD-2026-124720

Affected Vendors & Products

Vendor	Product	Version / Range
hono	node_server	From 2.0.0 (inc) to 2.1.6 (inc)
hono	node_server	1.19.18
hono	node_server	2.1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

The vulnerability in @hono/node-server versions before 1.19.18 and 2.0.0 to 2.1.6 involves improper handling of backslashes in request paths. The server passes raw request paths with backslashes to the WHATWG URL parser, which treats them as path separators. This can allow unauthenticated requests to bypass intended route restrictions enforced by upstream components like reverse proxies or firewalls.

Detection Guidance

Detecting this vulnerability requires checking the version of @hono/node-server in use. If you are running versions prior to 1.19.18 or between 2.0.0 and 2.1.6, the system is vulnerable. Inspect your package.json or run commands like 'npm list @hono/node-server' or 'yarn list @hono/node-server' to check the installed version.

Impact Analysis

This vulnerability may allow unauthorized access to restricted routes or content that should be blocked by upstream security measures. Attackers could exploit it to reach sensitive paths even if the Hono application's access controls are correctly configured.

Mitigation Strategies

Immediately upgrade @hono/node-server to version 1.19.18 or 2.1.6 or later. If upgrading is not possible, consider implementing a reverse proxy or WAF rule to block requests containing backslashes in the path before they reach the application.

Hi! I’m here to help you understand CVE-2026-126210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...