CVE-2026-126357

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.16

Description An unauthenticated client can bypass authentication or authorization middleware scoped to a subpath inside a mount prefix to reach protected routes. This occurs because mount() and app.mount() may remove a dynamic mount prefix using the route-pattern length instead of the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route. Additionally, rebuilding the forwarded URL from the decoded pathname can convert a decoded backslash into a slash and collapse parent-directory segments, leading to the same result.

Recommendations Update to version 4.13.16. As a temporary workaround, register the authentication middleware inside the mounted application.