CVE-2026-126210: @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse proxy, load balancer, or web application firewall that preserves the backslash and applies path-based rules to the original request can therefore permit a request that the application normalizes to a blocked route. This lets an unauthenticated client reach route content that the upstream component was intended to deny, while Hono application access controls are unaffected because they operate on the normalized path. This issue is fixed in versions 1.19.18 and 2.1.6.
Other sources
Summary
@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.
Details
A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.
The fix responds with 400 Bad Request to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.
Impact
An unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.
This affects applications served by @hono/node-server behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on /admin/, runs on the rewritten path and is not affected.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 1.19.18 - Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6 - Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 1.19.18 - Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments are exposed when @hono/node-server is behind a reverse proxy, load balancer, or web application firewall that preserves backslashes and enforces path-based rules against the original request path. Hono application access controls are not bypassed, because they operate on the normalized path.
What does an attacker need to exploit the issue?
An unauthenticated client only needs network access to send a crafted request containing backslashes and, where needed, dot segments in the path. Exploitation depends on an upstream component allowing the original path while the Node server normalizes it to a route that the upstream was intended to block.
Are default deployments affected?
The data does not establish whether a default reverse-proxy, load-balancer, or WAF configuration preserves backslashes and applies path rules before normalization. The vulnerable server versions are affected when used in the described upstream path-filtering arrangement.
How can I check whether a deployment is affected?
Review whether the deployment uses a vulnerable @hono/node-server version: versions before 1.19.18, or versions from 2.0.0 through 2.1.5. Then test or inspect upstream handling of paths such as /admin\secret and /public\..\admin/secret to determine whether the upstream permits the raw path while the application receives /admin/secret.
What should be done if updating is not immediately possible?
Ensure the reverse proxy, load balancer, or WAF rejects or normalizes backslashes and dot segments before applying path-based access-control rules or forwarding requests. Upgrade to @hono/node-server 1.19.18 or 2.1.6 when possible.