CVE-2026-126358
Deferred Deferred - Pending Action

Hono Framework Wildcard Middleware Bypass

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126358

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hono hono to 4.13.15 (inc)
hono hono 4.13.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Hono framework affects the RegExpRouter, which is the default router for most applications. It allows unauthenticated clients to bypass authentication or authorization middleware in three specific cases: when middleware using explicit default parameters is not applied to similar routes, when middleware on /admin/* does not cover /admin* paths, and when paths contain encoded line terminators. The issue exists in versions 4.1.4 to 4.13.15 of the hono npm package.

Detection Guidance

To detect this vulnerability, check the version of the Hono framework in use. If your application uses RegExpRouter or SmartRouter and runs version 4.1.4 to 4.13.15, it is vulnerable. Run 'npm list hono' or check your package.json to verify the installed version.

Impact Analysis

An attacker could exploit this vulnerability to access protected routes without proper authentication or authorization. This could lead to unauthorized data access, modification, or other malicious actions depending on the application's functionality. The impact is moderate with a CVSS score of 5.3, indicating a network-based attack with low complexity and no user interaction required.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected versions of Hono may face compliance violations if proper access controls are bypassed, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately update the Hono framework to version 4.13.16 or later. Alternatively, switch from RegExpRouter or SmartRouter to TrieRouter, LinearRouter, or PatternRouter, which are not affected by this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...