CVE-2026-126358

Name of the Vulnerable Software and Affected Versions Hono versions 4.1.4 through 4.13.15

Description RegExpRouter, which is selected by the default SmartRouter for most applications, fails to apply wildcard middleware in three specific scenarios. First, middleware using an explicit default parameter pattern, such as /api/:tenant{[^/]+}/admin/*, is not applied to routes written as /api/:tenant/admin/:id. Second, middleware on /admin/* is not applied to routes registered as /admin* for paths under /admin/. Third, request paths containing encoded line terminators (such as %0A, %0D, %E2%80%A8, or %E2%80%A9) can bypass wildcard middleware and reach the not-found handler. This occurs because the router's registration-time coverage calculation incorrectly treats certain matching patterns as different, and the compiled wildcard fails to match line terminators. Consequently, an unauthenticated client may access route handlers or the not-found handler without the required authentication or authorization middleware.

Recommendations Update Hono to version 4.13.16. As a temporary workaround, use new Hono({ router: new TrieRouter() }) to avoid the affected router.