CVE-2026-126210

Name of the Vulnerable Software and Affected Versions @hono/node-server versions prior to 1.19.18 @hono/node-server versions 2.0.0 through 2.1.5

Description An authorization bypass occurs when the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser. The parser treats the backslash as a path separator and resolves dot segments. If a reverse proxy, load balancer, or web application firewall preserves the backslash and applies path-based rules, an unauthenticated client can reach route content that the upstream component intended to deny, as the application normalizes the path after the security check.

Recommendations Update @hono/node-server to version 1.19.18 or later. Update @hono/node-server to version 2.1.6 or later.