CVE-2026-126344

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.1.5

Description The WebSocket upgrade path resolves a raw request-target starting with // against a base URL constructed from the Host header. This causes the WHATWG URL parser to treat the request-target as a network-path reference, which replaces the host in c.req.url. Because routing continues to use the local WebSocket path, applications that validate the Origin header against the origin of c.req.url (including those using csrf()) may incorrectly validate an attacker's origin. This allows a page on a different site to establish a WebSocket connection using the victim's cookies to read and send messages when the application utilizes upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not impacted.

Recommendations Update to version 2.1.6.