Web Application Framework Vulnerability in Hono from Hono

CVE-2026-126357

What is CVE-2026-126357?

The Hono web application framework features a vulnerability that allows unauthenticated users to exploit path transformations and access protected inner routes. Specifically, prior to version 4.13.16, the framework's mount() and app.mount() functions could erroneously strip away dynamic mount prefixes based on the length of the route pattern instead of the appropriate matched prefix length. This flaw permits crafted paths to bypass authentication and authorization middleware. Furthermore, a recent change prior to version 4.13.16 allowed for the conversion of backslashes to slashes and collapsing parent-directory segments, further facilitating unauthorized access to sensitive mounted routes. This vulnerability has been addressed in version 4.13.16.

References