Is CVE-2026-126210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126210 being exploited in the wild.

How severe is CVE-2026-126210?

Medium severity, with a CVSS score of 5.3, published 12 November 2026.

Which products and versions are affected?

Hono @Hono/Node-Server before 1.19.18, 2.0.0 to 2.1.5; Hono Node-Server = 2.0.0 and = 2.0.0, < 2.1.6, SEMVER:introduced=2.0.0,fixed=2.1.6.

Is there a fix for CVE-2026-126210?

Yes. @hono/node-server (npm): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126210 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126210?

Check whether you run Hono @Hono/Node-Server, Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126210: @hono/node-server path traversal via backslash bypass

Q: Is there a fix for CVE-2026-126210?

Yes. @hono/node-server (npm): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126210 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126210?

Check whether you run Hono @Hono/Node-Server, Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126210 · Severity: medium · CVSS 5.3 · Published 2026-11-12

@hono/node-server is a Node.js runtime for the Hono web framework. A path normalization flaw allows attackers to bypass access controls enforced by upstream reverse proxies or WAFs by embedding raw backslashes in request paths, which the Hono application incorrectly resolves to reach blocked routes. This grants unauthenticated attackers access to content that should be denied.

Technologies: Hono @Hono/Node-Server, @hono/node-server (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-126210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126210 being exploited in the wild.
How severe is CVE-2026-126210?: Medium severity, with a CVSS score of 5.3, published 12 November 2026.
Which products and versions are affected?: Hono @Hono/Node-Server before 1.19.18, 2.0.0 to 2.1.5; Hono Node-Server < 1.19.18, >= 2.0.0 and < 2.1.6; @hono/node-server (npm) >= 2.0.0, < 2.1.6, SEMVER:introduced=2.0.0,fixed=2.1.6.
Is there a fix for CVE-2026-126210?: Yes. @hono/node-server (npm): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126210 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126210?: Check whether you run Hono @Hono/Node-Server, Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hono/node-server (npm): upgrade to 2.1.6 or later
```
npm install @hono/node-server@2.1.6
```

Technical details

The vulnerability stems from passing raw request-target strings containing backslashes directly to the WHATWG URL parser, which treats backslashes as path separators and normalizes dot segments. Upstream proxies preserving the backslash in their path-based access control rules can allow a request that Hono then normalizes to a restricted route. The flaw affects HTTP/1.1, HTTP/2, and WebSocket upgrade requests in versions before 1.19.18 and 2.0.0–2.1.5; it is fixed by validating and rejecting requests with unencoded backslashes in the path before URL parsing.

Affected products

Hono @hono/node-server before 1.19.18, 2.0.0 to 2.1.5

Identifiers

CVE-2026-126210
GHSA-jpvv-r467-5p4w

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.