CVE-2026-126210: @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.
References
- github.com/advisories/GHSA-jpvv-r467-5p4w
- github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313
- github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c
- github.com/honojs/node-server/releases/tag/v1.19.18
- github.com/honojs/node-server/releases/tag/v2.1.6
- github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w
- nvd.nist.gov/vuln/detail/CVE-2026-126210
Code Behaviors & Features
Detect and mitigate CVE-2026-126210 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →