CVE-2026-126344 · Package
NO FIX YET · SEE WHAT TO DO
In @hono/node-server versions 2.0.0 through 2.1.5, a WebSocket upgrade request starting with // makes the request URL take an attacker-chosen host, so origin checks that rely on c.req.url accept cross-site connections. A malicious page on another site can then open a WebSocket using the victim's cookies and read and send messages.
first public Nov 2, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that use upgradeWebSocket and trust the host in c.req.url for Origin checks, including checks made with csrf(), are exposed. Ordinary HTTP routes are not affected, so applications without WebSocket endpoints can skip it.
Not affected if default-config, no-websocket
Who cares hono, node, self-hosted, websocket
npm ls @hono/node-server; versions from 2.0.0 up to but not including 2.1.6 are affected.upgradeWebSocket in the application code and for Origin checks that compare against c.req.url, including csrf() usage.2.1.6@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference and replace the host in c.req.url. Routing still uses the local WebSocket path, so an application that compares the Origin header with the origin of c.req.url, including checks implemented with csrf(), compares an attacker's origin with itself and accepts the connection. A page on another site can consequently open a WebSocket with the victim's cookies and read and send messages when the application uses upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not affected. This issue is fixed in version 2.1.6.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.