[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	2.1.5 → 2.1.6

---

@​hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

CVE-2026-126210 / GHSA-jpvv-r467-5p4w

More information

Details

Summary

@hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block.

Details

A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths.

The fix responds with 400 Bad Request to a request whose path contains a raw backslash, for HTTP/1.1, HTTP/2, absolute-form request-targets and WebSocket upgrades. A percent-encoded backslash and a backslash in the query string are still accepted.

Impact

An unauthenticated client can reach a route that a reverse proxy, load balancer or WAF in front of the application blocks by path.

This affects applications served by @hono/node-server behind a front component that makes path-based decisions and forwards a backslash unchanged. Access control inside the Hono application, such as middleware on /admin/*, runs on the rewritten path and is not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w
• https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313
• https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c
• https://github.com/honojs/node-server/releases/tag/v1.19.18
• https://github.com/honojs/node-server/releases/tag/v2.1.6
• https://github.com/advisories/GHSA-jpvv-r467-5p4w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​hono/node-server: Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

CVE-2026-126343 / GHSA-qv5m-9pm6-hqp3

More information

Details

Summary

While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates.

Details

The upgrade handler awaits the application before attaching any listener to the socket. When middleware on the upgrade path does asynchronous work, such as an authentication lookup, a connection reset in that window has no handler. If a global uncaughtException handler swallows the error, the pending upgrade is never released and its entry is retained for the lifetime of the process.

The fix attaches error and close listeners to the socket before calling the application, releases the pending upgrade when the socket closes, and skips the handshake on a destroyed socket.

Impact

An unauthenticated client can terminate the server process with a single connection by sending a WebSocket upgrade request and resetting the connection before the application has responded. Where the crash is suppressed, repeated requests grow the heap.

This affects applications that enable WebSocket support in @hono/node-server and run asynchronous middleware or handlers on the upgrade path.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3
• https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4
• https://github.com/honojs/node-server/releases/tag/v2.1.6
• https://github.com/advisories/GHSA-qv5m-9pm6-hqp3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.1.6

Compare Source

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.