# CVE-2026-126210: @hono/node-server path traversal via backslash bypass

Source: https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126210 · Severity: medium · CVSS 5.3 · Published 2026-11-12

@hono/node-server is a Node.js runtime for the Hono web framework. A path normalization flaw allows attackers to bypass access controls enforced by upstream reverse proxies or WAFs by embedding raw backslashes in request paths, which the Hono application incorrectly resolves to reach blocked routes. This grants unauthenticated attackers access to content that should be denied.

Technologies: [Hono @Hono/Node-Server](https://junglewise.ai/threats/technologies/node-server), [@hono/node-server (npm)](https://junglewise.ai/threats/technologies/hono-node-server). Vendors: [Hono](https://junglewise.ai/threats/vendors/hono), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126210 being exploited in the wild.

**How severe is CVE-2026-126210?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** Hono @Hono/Node-Server before 1.19.18, 2.0.0 to 2.1.5; Hono Node-Server < 1.19.18, >= 2.0.0 and < 2.1.6; @hono/node-server (npm) >= 2.0.0, < 2.1.6, SEMVER:introduced=2.0.0,fixed=2.1.6.

**Is there a fix for CVE-2026-126210?** Yes. @hono/node-server (npm): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126210 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126210?** Check whether you run Hono @Hono/Node-Server, Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hono/node-server (npm): upgrade to 2.1.6 or later

  ```sh
  npm install @hono/node-server@2.1.6
  ```


## Technical details

The vulnerability stems from passing raw request-target strings containing backslashes directly to the WHATWG URL parser, which treats backslashes as path separators and normalizes dot segments. Upstream proxies preserving the backslash in their path-based access control rules can allow a request that Hono then normalizes to a restricted route. The flaw affects HTTP/1.1, HTTP/2, and WebSocket upgrade requests in versions before 1.19.18 and 2.0.0–2.1.5; it is fixed by validating and rejecting requests with unencoded backslashes in the path before URL parsing.

## Affected products

- Hono @hono/node-server before 1.19.18, 2.0.0 to 2.1.5

## Identifiers

- CVE-2026-126210
- GHSA-jpvv-r467-5p4w

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313](https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313)
- [https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c](https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c)

## Related threats

- [@hono/node-server WebSocket upgrade host spoofing bypass](https://junglewise.ai/threats/cve-2026-126344-hono-node-server-allows-running-the-hono-application-on-node-js)
- [@hono/node-server WebSocket ECONNRESET denial of service](https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an)
- [@hono/node-server serveStatic path decoding bypass](https://junglewise.ai/threats/cve-2026-118663-hono-node-server-allows-running-the-hono-application-on-node-js)
- [Hono Node.js Adapter WebSocket memory leak DoS](https://junglewise.ai/threats/cve-2026-73565-hono-node-js-adapter-websocket-memory-leak-dos)
- [Hono Node.js Adapter path traversal in serve-static on Windows](https://junglewise.ai/threats/hono-node-js-adapter-path-traversal-in-serve-static-on-windows-4c8754f6)