CVE-2026-126210 is a medium-severity (CVSS 5.3) CWE-436 vulnerability in @hono/node-server. A fix is available for @hono/node-server — see the affected versions and patch details below.
@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@hono/node-servernpmDescription
Summary
@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.
Details
A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.
The fix responds with 400 Bad Request to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.
Impact
An unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.
This affects applications served by @hono/node-server behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on /admin/*, runs on the rewritten path and is not affected.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @hono/node-server | ≥ 2.0.0&&< 2.1.6 | 2.1.6npm install @hono/node-server@2.1.6 |
| 📦npm | @hono/node-server | all versions | 1.19.18npm install @hono/node-server@1.19.18 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @hono/node-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @hono/node-server to 2.1.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126210 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-126210 in your dependencies?
Find it across npm, including transitive dependencies.