CVE-2026-126357 is a medium-severity (CVSS 5.3) CWE-288 vulnerability in hono. A fix is available for hono — see the affected versions and patch details below.
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
hononpmDescription
Summary
mount() and app.mount() remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on /app/admin/*. The outer application routes on the original path, so the middleware does not run.
Details
- Dynamic prefix (all affected versions): for a mount such as
/api/:tenant/*, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so/api/a/xxxxx/admin/secretreaches the mounted application as/admin/secret. - Re-normalization (since 4.12.21): the forwarded path was built from the decoded request path and assigned to
url.pathname, which turns a decoded backslash into/and collapses.../app/public%5C..%5Cadmin/secretreaches the mounted application as/admin/secret.
The fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as /assets*. A trailing slash in an app.mount() prefix no longer removes an extra segment.
Impact
An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.
This affects applications that use mount() or app.mount() and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.
Workarounds
Register the authentication middleware inside the mounted application.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | hono | all versions | 4.13.16npm install hono@4.13.16 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hono, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update hono to 4.13.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126357 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-126357 in your dependencies?
Find it across npm, including transitive dependencies.