GHSA-jpvv-r467-5p4w: @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
Summary
@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.
Details
A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.
The fix responds with 400 Bad Request to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.
Impact
An unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.
This affects applications served by @hono/node-server behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on /admin/, runs on the rewritten path and is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 1.19.18 - Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6 - Compensating control
Reject requests whose path contains a raw backslash with HTTP 400 Bad Request, including HTTP/1.1, HTTP/2, absolute-form request-targets, and WebSocket upgrades.
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using @hono/node-server behind a reverse proxy, load balancer, or WAF that enforces access controls based on the request path are exposed when the intermediary preserves raw backslashes. nginx on Linux, HAProxy, and Envoy are identified as preserving them as ordinary characters.
What does an attacker need to exploit the issue?
An unauthenticated client only needs to send a request-target containing a raw backslash, such as /admin\secret or /public\..\admin/secret. The intermediary can apply its policy to the original path while the application interprets the path as /admin/secret.
What can be done before updating the affected package?
Ensure the front-facing HTTP recipient rejects request-targets containing raw backslashes with a 400 response, rather than correcting or forwarding them. RFC 9112 says recipients should reject raw backslashes in request-targets.
How can attempted exploitation be identified?
Inspect raw request-target or proxy logs for paths containing literal backslashes, especially patterns such as /admin\secret and /public\..\admin/secret. Application logs may show the normalized path instead, such as /admin/secret, because the URL parser treats backslashes as path separators.