CVE-2026-126344: @hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference and replace the host in c.req.url. Routing still uses the local WebSocket path, so an application that compares the Origin header with the origin of c.req.url, including checks implemented with csrf(), compares an attacker's origin with itself and accepts the connection. A page on another site can consequently open a WebSocket with the victim's cookies and read and send messages when the application uses upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not affected. This issue is fixed in version 2.1.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using @hono/node-server versions from 2.0.0 through 2.1.6 are exposed only if they use upgradeWebSocket and make Origin-validation decisions based on the origin of c.req.url while trusting its host. Ordinary HTTP request handling is not affected.
What does an attacker need to exploit this issue?
An attacker needs a victim to interact with a page hosted on another site. That page can initiate a WebSocket connection using the victim's cookies; exploitation does not require attacker privileges, but it does require user interaction.
Are applications using csrf() affected?
They can be affected when csrf() compares the Origin header against c.req.url during a WebSocket upgrade. A request-target beginning with // can cause c.req.url to contain an attacker-controlled host, making the Origin comparison succeed incorrectly.
How can exposure be mitigated?
Upgrade @hono/node-server to version 2.1.6. Until upgrading is possible, avoid relying on c.req.url's origin or Host-derived values for WebSocket Origin validation, and validate the Origin header against a fixed allowlist of expected application origins.