{"id":"CVE-2026-126357","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126357","summary":"Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix","details":"### Summary\n\n`mount()` and `app.mount()` remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on `/app/admin/*`. The outer application routes on the original path, so the middleware does not run.\n\n### Details\n\n1. **Dynamic prefix** (all affected versions): for a mount such as `/api/:tenant/*`, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so `/api/a/xxxxx/admin/secret` reaches the mounted application as `/admin/secret`.\n2. **Re-normalization** (since 4.12.21): the forwarded path was built from the decoded request path and assigned to `url.pathname`, which turns a decoded backslash into `/` and collapses `..`. `/app/public%5C..%5Cadmin/secret` reaches the mounted application as `/admin/secret`.\n\nThe fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as `/assets*`. A trailing slash in an `app.mount()` prefix no longer removes an extra segment.\n\n### Impact\n\nAn unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.\n\nThis affects applications that use `mount()` or `app.mount()` and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.\n\n### Workarounds\n\nRegister the authentication middleware inside the mounted application.","published":"2026-11-12T23:24:11Z","modified":"2026-11-12T23:30:03.867783771Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"hono","fixedVersion":"4.13.16"}],"fix":{"url":"https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6","label":"honojs/hono@34f9043"},"references":[{"type":"WEB","url":"https://github.com/honojs/hono/security/advisories/GHSA-4m76-xfj5-7975"},{"type":"WEB","url":"https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6"},{"type":"PACKAGE","url":"https://github.com/honojs/hono"},{"type":"WEB","url":"https://github.com/honojs/hono/releases/tag/v4.13.16"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-12T23:30:03.867783771Z"}}