CVE-2026-126357
Deferred Deferred - Pending Action

Path Traversal in Hono Web Framework

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route while the outer application routes the original path. Since 4.12.21, rebuilding the forwarded URL from the decoded pathname can also convert a decoded backslash to a slash and collapse parent-directory segments, again causing the mounted application to receive a protected path. An unauthenticated client can use either applicable path transformation to reach a mounted route without authentication or authorization middleware scoped to a subpath inside the mount prefix. This issue is fixed in version 4.13.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126357

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
honojs hono to 4.13.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Hono web framework versions prior to 4.13.16. It involves the mount() and app.mount() functions which are used to attach sub-applications or middleware at a specific path prefix. Due to flaws in path handling, crafted requests can bypass path-scoped middleware in the outer application, allowing unauthenticated access to protected routes in the mounted application.

Detection Guidance

Check your Hono.js framework version with: npm list hono. If the version is below 4.13.16, the system is vulnerable. Inspect application logs for unusual path patterns like encoded backslashes or dynamic prefix bypass attempts.

Impact Analysis

An unauthenticated attacker could exploit this to access protected routes in a mounted application that rely on path-scoped middleware in the outer application for authentication or authorization. This could lead to unauthorized access to sensitive data or functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to protected routes in mounted applications, potentially exposing sensitive data. For GDPR, this may result in unauthorized data access, violating principles of data protection and user rights. For HIPAA, it could allow unauthorized access to protected health information, compromising confidentiality requirements.

Mitigation Strategies

Upgrade Hono.js to version 4.13.16 or later using: npm update hono. If immediate upgrade is not possible, add authentication middleware directly within mounted applications as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...