Security fixes
This release includes a fix for the following security issue:
Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w
A request whose path contains a raw backslash is now rejected with 400 Bad Request. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.
The same fix, together with two WebSocket fixes, ships in @hono/node-server v2.1.6. Users on 1.x who can upgrade to 2.x are encouraged to do so.