CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse proxy, load balancer, or web application firewall that preserves the backslash and applies path-based rules to the original request can therefore permit a request that the application normalizes to a blocked route. This lets an unauthenticated client reach route content that the upstream component was intended to deny, while Hono application access controls are unaffected because they operate on the normalized path. This issue is fixed in versions 1.19.18 and 2.1.6.

• CWE-436

• https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313
• https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c
• https://github.com/honojs/node-server/releases/tag/v1.19.18
• https://github.com/honojs/node-server/releases/tag/v2.1.6
• https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126205Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126206Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126207Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126208Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126209Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-126211A improper privilege management vulnerability in Fortinet Fo…7.2
• CVE-2026-126212A heap-based buffer overflow vulnerability in Fortinet Forti…7.2
• CVE-2026-126213A improper neutralization of special elements used in an sql…7.1
• CVE-2026-126214A authentication bypass by spoofing vulnerability in Fortine…7.2
• CVE-2026-126215A incorrect authorization vulnerability in Fortinet FortiAna…8.2
• CVE-2026-126216A improper privilege management vulnerability in Fortinet Fo…3.8