{"id":"CVE-2026-126344","kind":"vulnerability","aliases":["CVE-2026-126344"],"related":[],"title":"@hono/node-server: WebSocket host spoofing lets cross-site pages hijack connections","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference and replace the host in c.req.url. Routing still uses the local WebSocket path, so an application that compares the Origin header with the origin of c.req.url, including checks implemented with csrf(), compares an attacker's origin with itself and accepts the connection. A page on another site can consequently open a WebSocket with the victim's cookies and read and send messages when the application uses upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not affected. This issue is fixed in version 2.1.6.","summary":"In @hono/node-server versions 2.0.0 through 2.1.5, a WebSocket upgrade request starting with // makes the request URL take an attacker-chosen host, so origin checks that rely on c.req.url accept cross-site connections. A malicious page on another site can then open a WebSocket using the victim's cookies and read and send messages.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hono","node","package","self-hosted","websocket"],"not_affected_if":["default-config","no-websocket"],"how_to_check":"- Check the installed version with `npm ls @hono/node-server`; versions from `2.0.0` up to but not including `2.1.6` are affected.\n- Look for `upgradeWebSocket` in the application code and for Origin checks that compare against `c.req.url`, including `csrf()` usage.","fix":"- @hono/node-server: upgrade to `2.1.6`","status":"open","published_at":"2026-11-12T22:19:19+00:00","first_seen_at":"2026-11-12T22:40:37+00:00","triaged_at":"2026-11-12T22:42:31+00:00","updated_at":"2026-11-12T22:42:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T22:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- @hono/node-server: upgrade to `2.1.6`","reach":"internet","title":"@hono/node-server: WebSocket host spoofing lets cross-site pages hijack connections","impact":"medium","summary":"In @hono/node-server versions 2.0.0 through 2.1.5, a WebSocket upgrade request starting with // makes the request URL take an attacker-chosen host, so origin checks that rely on c.req.url accept cross-site connections. A malicious page on another site can then open a WebSocket using the victim's cookies and read and send messages.","audience":"developers","category":"package","nicknames":[],"who_cares":["hono","node","websocket","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"cross-site pages read and send WebSocket messages as the victim","analyst_note":"Ecosystem and product_name are not supplied, so the product is named only in text; the nvd entry gives no affected-product list beyond the description.","how_to_check":"- Check the installed version with `npm ls @hono/node-server`; versions from `2.0.0` up to but not including `2.1.6` are affected.\n- Look for `upgradeWebSocket` in the application code and for Origin checks that compare against `c.req.url`, including `csrf()` usage.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-websocket","default-config"],"who_is_affected":"Only applications that use upgradeWebSocket and trust the host in c.req.url for Origin checks, including checks made with csrf(), are exposed. Ordinary HTTP routes are not affected, so applications without WebSocket endpoints can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000783,"input_tokens":4746,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126344':14A,17A '-2026':13A,16A '2.0.0':28B,89C '2.1.5':30B '2.1.6':91C,215C 'accept':54B,169C 'affect':208C 'allow':81C 'anoth':63B,175C 'applic':85C,145C,194C 'attack':44B,163C 'attacker-chosen':43B 'base':106C 'begin':102C 'built':108C 'c.req.url':53B,135C,155C,202C 'caus':113C 'check':49B,157C 'chosen':45B 'compar':147C,161C 'connect':11A,58B,171C 'consequ':178C 'cooki':74B,186C 'cross':7A,56B 'cross-sit':6A,55B 'csrf':160C 'cve':12A,15A 'fix':212C 'header':112C,150C 'hijack':10A 'hono':18B,84C 'hono/node-server':1A,26B,80C 'host':3A,23B,46B,111C,133C,200C 'http':204C 'implement':158C 'includ':156C 'issu':210C 'let':5A 'local':140C 'make':37B 'malici':60B 'messag':79B,191C 'network':127C 'network-path':126C 'node':19B 'node.js':87C 'open':67B,179C 'ordinari':203C 'origin':48B,149C,153C,165C 'packag':20B 'page':9A,61B,173C 'parser':117C 'path':95C,128C,142C 'raw':98C 'read':76B,188C 'refer':129C 'reli':51B 'replac':131C 'request':34B,39B,100C,122C,205C 'request-target':99C,121C 'resolv':96C 'rout':136C 'run':82C 'self':22B 'self-host':21B 'send':78B,190C 'site':8A,57B,64B,176C 'spoof':4A 'start':35B 'still':137C 'take':41B 'target':101C,123C 'treat':119C 'trust':198C 'upgrad':33B,94C 'upgradewebsocket':196C 'url':40B,107C,116C 'use':70B,138C,195C 'version':27B,214C 'victim':72B,184C 'websocket':2A,24B,32B,69B,93C,141C,181C 'whatwg':115C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use upgradeWebSocket and trust the host in c.req.url for Origin checks, including checks made with csrf(), are exposed. Ordinary HTTP routes are not affected, so applications without WebSocket endpoints can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hono","medium","node","package","selfhosted","websocket"],"campaign_type":null,"search_a":"'-126344':14A,17A '-2026':13A,16A 'connect':11A 'cross':7A 'cross-sit':6A 'cve':12A,15A 'hijack':10A 'hono/node-server':1A 'host':3A 'let':5A 'page':9A 'site':8A 'spoof':4A 'websocket':2A","search_b":"'2.0.0':28B '2.1.5':30B 'accept':54B 'anoth':63B 'attack':44B 'attacker-chosen':43B 'c.req.url':53B 'check':49B 'chosen':45B 'connect':58B 'cooki':74B 'cross':56B 'cross-sit':55B 'hono':18B 'hono/node-server':26B 'host':23B,46B 'make':37B 'malici':60B 'messag':79B 'node':19B 'open':67B 'origin':48B 'packag':20B 'page':61B 'read':76B 'reli':51B 'request':34B,39B 'self':22B 'self-host':21B 'send':78B 'site':57B,64B 'start':35B 'take':41B 'upgrad':33B 'url':40B 'use':70B 'version':27B 'victim':72B 'websocket':24B,32B,69B","search_c":"'2.0.0':89C '2.1.6':91C,215C 'accept':169C 'affect':208C 'allow':81C 'anoth':175C 'applic':85C,145C,194C 'attack':163C 'base':106C 'begin':102C 'built':108C 'c.req.url':135C,155C,202C 'caus':113C 'check':157C 'compar':147C,161C 'connect':171C 'consequ':178C 'cooki':186C 'csrf':160C 'fix':212C 'header':112C,150C 'hono':84C 'hono/node-server':80C 'host':111C,133C,200C 'http':204C 'implement':158C 'includ':156C 'issu':210C 'local':140C 'messag':191C 'network':127C 'network-path':126C 'node.js':87C 'open':179C 'ordinari':203C 'origin':149C,153C,165C 'page':173C 'parser':117C 'path':95C,128C,142C 'raw':98C 'read':188C 'refer':129C 'replac':131C 'request':100C,122C,205C 'request-target':99C,121C 'resolv':96C 'rout':136C 'run':82C 'send':190C 'site':176C 'still':137C 'target':101C,123C 'treat':119C 'trust':198C 'upgrad':94C 'upgradewebsocket':196C 'url':107C,116C 'use':138C,195C 'version':214C 'victim':184C 'websocket':93C,141C,181C 'whatwg':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T10:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126344","severity":null,"published_at":"2026-11-12T22:19:19+00:00","modified_at":"2026-11-12T22:19:19+00:00","first_seen_at":"2026-11-12T22:40:37+00:00","fetched_at":"2026-11-12T22:40:37+00:00","note":null}],"documents":[{"id":139793,"url":"https://github.com/honojs/node-server/commit/cfaa79f76dbb0fe9f539438c0c585d94ed7cd01f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":139199,"url":"https://github.com/honojs/node-server/releases/tag/v2.1.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":139795,"url":"https://github.com/honojs/node-server/security/advisories/GHSA-7v5p-43qr-wch5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T10:20:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}