---
id: "CVE-2026-126344"
page: "https://infrastack.ai/live/CVE-2026-126344"
kind: "vulnerability"
aliases: ["CVE-2026-126344"]
title: "@hono/node-server: WebSocket host spoofing lets cross-site pages hijack connections"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hono", "node", "package", "self-hosted", "websocket"]
not_affected_if: ["default-config", "no-websocket"]
published_at: "2026-11-12T22:19:19+00:00"
first_seen_at: "2026-11-12T22:40:37+00:00"
updated_at: "2026-11-12T22:42:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126344", "first_seen_at": "2026-11-12T22:40:37+00:00"}]
exploit_sources: []
---

# @hono/node-server: WebSocket host spoofing lets cross-site pages hijack connections

Link for people: https://infrastack.ai/live/CVE-2026-126344 (this .md is for agents)

In @hono/node-server versions 2.0.0 through 2.1.5, a WebSocket upgrade request starting with // makes the request URL take an attacker-chosen host, so origin checks that rely on c.req.url accept cross-site connections. A malicious page on another site can then open a WebSocket using the victim's cookies and read and send messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls @hono/node-server`; versions from `2.0.0` up to but not including `2.1.6` are affected.
- Look for `upgradeWebSocket` in the application code and for Origin checks that compare against `c.req.url`, including `csrf()` usage.

## Fix

- @hono/node-server: upgrade to `2.1.6`

## Timeline

- 2026-11-12T22:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126344

## Documents

- [advisory] Vendor advisory: github.com https://github.com/honojs/node-server/security/advisories/GHSA-7v5p-43qr-wch5
- [fix] Patch: github.com https://github.com/honojs/node-server/commit/cfaa79f76dbb0fe9f539438c0c585d94ed7cd01f
- [fix] Release: github.com https://github.com/honojs/node-server/releases/tag/v2.1.6

## From the sources

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference and replace the host in c.req.url. Routing still uses the local WebSocket path, so an application that compares the Origin header with the origin of c.req.url, including checks implemented with csrf(), compares an attacker's origin with itself and accepts the connection. A page on another site can consequently open a WebSocket with the victim's cookies and read and send messages when the application uses upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not affected. This issue is fixed in version 2.1.6.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_