CVE-2026-47676

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.21

Description In the app.mount() function, the mount prefix is stripped from the incoming request path using the raw URL pathname, whereas route matching is conducted against the percent-decoded path. This inconsistency leads to the prefix being removed from the incorrect position when the path includes percent-encoded multi-byte characters, causing the mounted sub-application to receive an incorrect path.

Recommendations Update to version 4.12.21.