WebSocket Vulnerability in Hono Application on Node.js
CVE-2026-126344

5.4MEDIUM

Key Information:

Vendor

Honojs

Status
Node-server
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126344?

A vulnerability in the Hono application on Node.js allows attackers to exploit the WebSocket upgrade mechanism. When the request-target starts with '//', it can lead to a misleading resolution of the Host header. As a result, the application's security checks may mistakenly accept connections from malicious sources that mimic legitimate origins. This flaw primarily impacts WebSocket functionality, enabling unauthorized access to user cookies and sensitive data exchanged during communication. The issue is mitigated in version 2.1.6.

Affected Version(s)

node-server >= 2.0.0, < 2.1.6

References

https://github.com/honojs/node-server/security/advisories...
x_refsource_CONFIRM
https://github.com/honojs/node-server/commit/cfaa79f76dbb...
x_refsource_MISC
https://github.com/honojs/node-server/releases/tag/v2.1.6
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.