{"id":"CVE-2026-126210","kind":"vulnerability","aliases":["CVE-2026-126210","GHSA-jpvv-r467-5p4w"],"related":[],"title":"@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy","description":"### Summary\n\n`@hono/node-server` passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as `/` and then resolves `..` segments. A request for `/admin\\secret` or `/public\\..\\admin/secret` reaches the application as `/admin/secret`. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.\n\n### Details\n\nA raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.\n\nThe fix responds with `400 Bad Request` to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.\n\n### Impact\n\nAn unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.\n\nThis affects applications served by `@hono/node-server` behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on `/admin/*`, runs on the rewritten path and is not affected.","summary":"The @hono/node-server package turns a backslash in a request path into a slash, so a request like /admin\\secret reaches the app as /admin/secret. An unauthenticated attacker can therefore reach routes that a reverse proxy or WAF in front of the app was configured to block by path.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@hono/node-server","fixed":["2.1.6"],"affected":">= 2.0.0, < 2.1.6","ecosystem":"npm"},{"name":"@hono/node-server","fixed":["1.19.18"],"affected":"< 1.19.18","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-436","hono","node.js","package","reverse-proxy","self-hosted"],"not_affected_if":["access-control-in-app-only","no-path-based-proxy-rules"],"how_to_check":"- Run `npm ls @hono/node-server` in the project to see the installed version.\n- Check whether the app sits behind a reverse proxy, load balancer or WAF that makes decisions based on URL path.\n- Test whether a raw backslash in a path (for example `/admin\\secret`) is forwarded unchanged by that front component.","fix":"- `@hono/node-server` 2.x: move to `2.1.6`\n- `@hono/node-server` 1.x: move to `1.19.18`","status":"open","published_at":"2026-11-12T21:28:02+00:00","first_seen_at":"2026-11-12T21:29:45+00:00","triaged_at":"2026-11-12T21:31:48+00:00","updated_at":"2026-11-12T21:31:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T21:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- `@hono/node-server` 2.x: move to `2.1.6`\n- `@hono/node-server` 1.x: move to `1.19.18`","reach":"internet","title":"@hono/node-server: backslash in request path bypasses reverse-proxy path rules","impact":"medium","summary":"The @hono/node-server package turns a backslash in a request path into a slash, so a request like /admin\\secret reaches the app as /admin/secret. An unauthenticated attacker can therefore reach routes that a reverse proxy or WAF in front of the app was configured to block by path.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","hono","self-hosted","reverse-proxy"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests reach routes a front proxy was meant to block","analyst_note":"","how_to_check":"- Run `npm ls @hono/node-server` in the project to see the installed version.\n- Check whether the app sits behind a reverse proxy, load balancer or WAF that makes decisions based on URL path.\n- Test whether a raw backslash in a path (for example `/admin\\secret`) is forwarded unchanged by that front component.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-path-based-proxy-rules","access-control-in-app-only"],"who_is_affected":"Applications that use @hono/node-server and sit behind a reverse proxy, load balancer or WAF that enforces access rules by URL path and forwards a raw backslash unchanged. Access control implemented inside the Hono application itself runs on the rewritten path and is not affected, so apps without a path-based front layer can deprioritize it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000832,"input_tokens":5145,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126210':25A,33A '-2026':24A,32A '-436':37B '/admin':64B,123C,324C '/admin/secret':70B,132C '/public':126C '3.2':189C '3.2.1':184C '3986':139C,180C '400':230C '5p4w':30A '9112':182C,187C 'absolut':246C 'absolute-form':245C 'accept':268C 'access':17A,314C 'admin/secret':127C 'affect':294C,333C 'allow':173C 'app':68B,88B 'appli':145C 'applic':130C,222C,289C,295C,319C 'attack':73B 'backslash':2A,52B,111C,142C,170C,213C,241C,258C,261C,312C 'bad':231C 'balanc':282C 'base':16A,149C,307C 'behind':299C 'block':92B,166C,290C 'bypass':13A 'charact':217C 'client':272C 'compon':302C 'configur':90B 'contain':238C 'control':18A,315C 'correct':200C 'cve':23A,31A 'cwe':36B 'decis':308C 'detail':167C 'differ':224C 'encod':257C 'envoy':210C 'fix':227C 'follow':137C 'form':247C 'forward':140C,310C 'front':85B,286C,301C 'ghsa':27A 'ghsa-jpvv-r467-5p4w':26A 'haproxi':208C 'hono':38B,318C 'hono/node-server':1A,34A,35A,48B,96C,298C 'host':46B 'http/1.1':243C 'http/2':244C 'impact':269C 'insid':316C 'jpvv':28A 'keep':211C 'like':63B 'linux':207C 'load':281C 'make':304C 'meant':164C 'middlewar':322C 'nginx':205C 'node.js':39B 'ordinari':216C 'origin':153C 'packag':40B,49B 'pars':8A 'parser':107C 'pass':97C 'path':6A,11A,15A,56B,94B,114C,148C,154C,225C,237C,292C,306C,329C 'path-bas':14A,147C,305C 'percent':256C 'percent-encod':255C 'proxi':22A,43B,81B,135C,162C,202C,280C 'queri':264C 'r467':29A 'rather':198C 'raw':99C,169C,240C 'reach':66B,76B,128C,158C,274C 'recipi':192C 'reject':194C 'request':5A,55B,62B,101C,121C,157C,177C,197C,232C,235C,249C 'request-target':100C,176C,248C 'resolv':118C 'respond':228C 'revers':21A,42B,80B,134C,279C 'reverse-proxi':41B 'rewritten':328C 'rfc':138C,179C,181C,186C 'rout':77B,160C,276C 'rule':150C 'run':325C 'say':190C 'secret':65B,124C 'section':183C,188C 'see':223C 'segment':119C 'self':45B 'self-host':44B 'separ':12A 'serv':296C 'slash':59B 'still':267C 'string':265C 'summari':95C 'target':102C,178C,250C 'therefor':75B 'treat':109C 'turn':50B 'unauthent':72B,271C 'unchang':143C,313C 'upgrad':253C 'url':106C 'waf':83B,284C 'websocket':252C 'whatwg':105C 'whose':236C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @hono/node-server and sit behind a reverse proxy, load balancer or WAF that enforces access rules by URL path and forwards a raw backslash unchanged. Access control implemented inside the Hono application itself runs on the rewritten path and is not affected, so apps without a path-based front layer can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nodeserver"],"ptokens":["hono","node","server"],"labels":["cwe436","hono","medium","nodejs","npm","package","reverseproxy","selfhosted"],"campaign_type":null,"search_a":"'-126210':25A,33A '-2026':24A,32A '5p4w':30A 'access':17A 'backslash':2A 'base':16A 'bypass':13A 'control':18A 'cve':23A,31A 'ghsa':27A 'ghsa-jpvv-r467-5p4w':26A 'hono/node-server':1A,34A,35A 'jpvv':28A 'pars':8A 'path':6A,11A,15A 'path-bas':14A 'proxi':22A 'r467':29A 'request':5A 'revers':21A 'separ':12A","search_b":"'-436':37B '/admin':64B '/admin/secret':70B 'app':68B,88B 'attack':73B 'backslash':52B 'block':92B 'configur':90B 'cwe':36B 'front':85B 'hono':38B 'hono/node-server':48B 'host':46B 'like':63B 'node.js':39B 'packag':40B,49B 'path':56B,94B 'proxi':43B,81B 'reach':66B,76B 'request':55B,62B 'revers':42B,80B 'reverse-proxi':41B 'rout':77B 'secret':65B 'self':45B 'self-host':44B 'slash':59B 'therefor':75B 'turn':50B 'unauthent':72B 'waf':83B","search_c":"'/admin':123C,324C '/admin/secret':132C '/public':126C '3.2':189C '3.2.1':184C '3986':139C,180C '400':230C '9112':182C,187C 'absolut':246C 'absolute-form':245C 'accept':268C 'access':314C 'admin/secret':127C 'affect':294C,333C 'allow':173C 'appli':145C 'applic':130C,222C,289C,295C,319C 'backslash':111C,142C,170C,213C,241C,258C,261C,312C 'bad':231C 'balanc':282C 'base':149C,307C 'behind':299C 'block':166C,290C 'charact':217C 'client':272C 'compon':302C 'contain':238C 'control':315C 'correct':200C 'decis':308C 'detail':167C 'differ':224C 'encod':257C 'envoy':210C 'fix':227C 'follow':137C 'form':247C 'forward':140C,310C 'front':286C,301C 'haproxi':208C 'hono':318C 'hono/node-server':96C,298C 'http/1.1':243C 'http/2':244C 'impact':269C 'insid':316C 'keep':211C 'linux':207C 'load':281C 'make':304C 'meant':164C 'middlewar':322C 'nginx':205C 'ordinari':216C 'origin':153C 'parser':107C 'pass':97C 'path':114C,148C,154C,225C,237C,292C,306C,329C 'path-bas':147C,305C 'percent':256C 'percent-encod':255C 'proxi':135C,162C,202C,280C 'queri':264C 'rather':198C 'raw':99C,169C,240C 'reach':128C,158C,274C 'recipi':192C 'reject':194C 'request':101C,121C,157C,177C,197C,232C,235C,249C 'request-target':100C,176C,248C 'resolv':118C 'respond':228C 'revers':134C,279C 'rewritten':328C 'rfc':138C,179C,181C,186C 'rout':160C,276C 'rule':150C 'run':325C 'say':190C 'secret':124C 'section':183C,188C 'see':223C 'segment':119C 'serv':296C 'still':267C 'string':265C 'summari':95C 'target':102C,178C,250C 'treat':109C 'unauthent':271C 'unchang':143C,313C 'upgrad':253C 'url':106C 'waf':284C 'websocket':252C 'whatwg':105C 'whose':236C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T10:20:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jpvv-r467-5p4w","url":"https://github.com/advisories/GHSA-jpvv-r467-5p4w","severity":"medium","published_at":"2026-11-12T21:28:02+00:00","modified_at":"2026-11-12T21:28:03+00:00","first_seen_at":"2026-11-12T21:29:45+00:00","fetched_at":"2026-11-12T21:38:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-126210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126210","severity":null,"published_at":"2026-11-12T22:19:18+00:00","modified_at":"2026-11-12T22:19:18+00:00","first_seen_at":"2026-11-12T22:40:37+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[{"id":139194,"url":"https://api.github.com/repos/honojs/node-server/security-advisories/GHSA-jpvv-r467-5p4w","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":139195,"url":"https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-02T10:20:37+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":139196,"url":"https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139197,"url":"https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139198,"url":"https://github.com/honojs/node-server/releases/tag/v1.19.18","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":139199,"url":"https://github.com/honojs/node-server/releases/tag/v2.1.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}