CVE-2026-126357: Authentication Bypass via Mount Path Transformation in Hono

Vulnerability ID: CVE-2026-126357
CVSS Score: 5.3
Published: 2026-11-12

CVE-2026-126357 (GHSA-4m76-xfj5-7975) is an authentication bypass vulnerability in the Hono web application framework prior to version 4.13.16. The flaw resides in the prefix-stripping and URL reconstruction logic of app.mount() and the mount() middleware. Two distinct path transformation errors—static route-pattern length slicing on dynamic prefixes and URL normalization of decoded pathnames—create a routing discrepancy between the outer Hono router and the mounted sub-application. An unauthenticated attacker can exploit these discrepancies to bypass outer authentication or authorization middleware and access protected inner routes directly.

TL;DR

Hono versions prior to 4.13.16 contain two path transformation flaws in app.mount() and mount() middleware. Slicing request paths by static pattern length instead of actual matched parameter length, combined with re-parsing decoded URL pathnames containing encoded backslashes or traversal sequences, allows unauthenticated attackers to bypass outer route middleware and reach protected sub-application endpoints.

Technical Details

• Vulnerability ID: CVE-2026-126357 / GHSA-4m76-xfj5-7975
• Weakness Class: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
• Attack Vector: Network (Unauthenticated HTTP Request with crafted URL path)
• Affected Versions: hono < 4.13.16
• Patched Version: hono 4.13.16
• Exploit Status: No known public exploits
• CISA KEV Status: Not Listed

Affected Systems

• hono
• @hono/node-server
• @hono/cloudflare-workers
• @hono/deno
• @hono/bun
• hono: < 4.13.16 (Fixed in: 4.13.16)

Code Analysis

Commit: 34f9043

Fix dynamic mount prefix stripping and raw path prefix preservation to prevent middleware bypass

Mitigation Strategies

• Upgrade the hono dependency to version 4.13.16 or newer across all JavaScript runtimes.
• Register authentication and authorization middleware directly inside the mounted sub-application rather than on subpaths of the outer router.
• Replace dynamic route parameters in app.mount() prefixes with static path prefixes.
• Block requests containing encoded backslashes (%5C) and traversal sequences (%2e%2e) at the reverse proxy or WAF layer.

Remediation Steps:

1. Audit application source code for usage of app.mount() or the mount() middleware.
2. Update package.json to require hono >= 4.13.16 and run npm install, pnpm update, yarn upgrade, or bun update.
3. Verify that no custom replaceRequest callbacks supplied to app.mount() reconstruct URLs using decoded pathnames.
4. Redeploy affected serverless functions, edge workers, or Node.js/Bun/Deno services.

References

• Official CVE Record: CVE-2026-126357
• CVE Project v5 Record JSON
• GitHub Security Advisory GHSA-4m76-xfj5-7975
• Official Fix Commit in honojs/hono
• Hono Release Tag v4.13.16
• National Vulnerability Database (NVD) - CVE-2026-126357
• CWE-288: Authentication Bypass Using an Alternate Path or Channel
• FIRST CVSS v3.1 Calculator
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-126357 on our website for more details including interactive diagrams and full exploit analysis.