Path Traversal Vulnerability in Hono Node.js Server by Hono
CVE-2026-126210
5.3MEDIUM
What is CVE-2026-126210?
A vulnerability in the Hono Node.js server allows for unauthorized access to protected resources due to improper handling of backslashes in URL paths. When a request contains a backslash, it is incorrectly treated as a path separator by the WHATWG URL parser, potentially allowing unauthenticated clients to access content that should be restricted. This issue arises because the server's access controls operate on a normalized path that does not consider the backslash, making it possible for malicious requests to bypass intended protections. The vulnerability is addressed in version 1.19.18 and later, as well as in version 2.1.6.
Affected Version(s)
node-server >= 2.0.0, < 2.1.6 < 2.0.0, 2.1.6
node-server < 1.19.18 < 1.19.18