CVE-2026-126358: Authorization Bypass via Wildcard Middleware Omission in Hono RegExpRouter

Vulnerability ID: CVE-2026-126358
CVSS Score: 5.3
Published: 2026-11-12

An incorrect authorization vulnerability (CWE-863) exists in the Hono web application framework (npm package hono) from version 4.1.4 prior to 4.13.16. Flaws in the registration-time coverage calculation and regular expression compilation within RegExpRouter cause wildcard middleware to be omitted under three specific routing conditions: parameter pattern equivalence mismatches, wildcard boundary collisions, and request paths containing percent-encoded line terminators. Because Hono's default SmartRouter selects RegExpRouter for most standard web applications, unauthenticated remote clients can bypass authentication, authorization, or security middleware registered on wildcard paths to directly access protected route handlers or the application's not-found handler.

TL;DR

Hono versions 4.1.4 through 4.13.15 contain flaws in RegExpRouter that cause wildcard middleware to be skipped when mixing explicit regex parameter syntax with shorthand syntax, combining /path/* middleware with /path* routes, or processing request paths containing encoded line terminators (%0A, %0D, %E2%80%A8, %E2%80%A9). Upgrading to Hono 4.13.16 resolves all three bypass vectors.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-126358 (GHSA-h7mg-cq63-vhpq)
• Vulnerability Class: CWE-863: Incorrect Authorization
• Affected Component: Hono RegExpRouter (npm: hono >= 4.1.4, < 4.13.16)
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
• EPSS Score: 0.35% (28.76th Percentile)
• Attack Vector: Unauthenticated Network HTTP Request
• Exploit Status: Proof-of-Concept (Unit test reproduction available)
• Patched Version: hono v4.13.16

Affected Systems

• Hono Web Application Framework (npm package: hono)
• hono: >= 4.1.4, < 4.13.16 (Fixed in: 4.13.16)

Code Analysis

Commit: 8a103aa

Replace string-based wildcard regex caching with structural trie branch coverage calculation (covers()) and update wildcard regex constants from .* to [^]* to match line terminators.

--- a/src/router/reg-exp-router/node.ts
+++ b/src/router/reg-exp-router/node.ts
-export const ONLY_WILDCARD_REG_EXP_STR = '.*'
-export const TAIL_WILDCARD_REG_EXP_STR = '(?:|/.*)'
+// Match line terminators without changing the flags of user-defined parameter patterns.
+export const ONLY_WILDCARD_REG_EXP_STR = '[^]*'
+export const TAIL_WILDCARD_REG_EXP_STR = '(?:|/[^]*)'

--- a/src/router/reg-exp-router/trie.ts
+++ b/src/router/reg-exp-router/trie.ts
-const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./g) || []
+const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./gs) || []

Mitigation Strategies

• Upgrade the hono package to version 4.13.16 or later to incorporate the structural trie coverage calculation and [^]* wildcard compilation fixes.
• Explicitly configure Hono applications to use TrieRouter, LinearRouter, or PatternRouter instead of the default SmartRouter (RegExpRouter) if upgrading is not immediately possible.
• Standardize route parameter definitions across middleware and route handlers by avoiding mixed usage of :param{[^/]+} and :param, and avoid combining /prefix/* middleware with /prefix* routes.
• Deploy edge proxy or WAF filtering rules to reject incoming HTTP requests containing percent-encoded line terminators (%0A, %0D, %E2%80%A8, %E2%80%A9) in the URI path.

Remediation Steps:

1. Identify all projects and microservices using the hono package within the affected range (>= 4.1.4, < 4.13.16).
2. Run npm install hono@latest (or the equivalent command for pnpm, yarn, or bun) to update hono to version 4.13.16 or higher.
3. Audit application routing definitions for any instances where app.use('/path/*') pairs with app.all('/path*') or where explicit parameter regexes (:param{[^/]+}) mix with bare parameters (:param).
4. Add regression tests to the application's test suite verifying that unauthenticated requests to protected routes and requests containing %0A in the path return 401 Unauthorized or 403 Forbidden as expected.
5. Redeploy the updated application bundles to production environments (Cloudflare Workers, Node.js containers, Deno Deploy, or Bun servers).

References

• CVE-2026-126358 Official CVE.org Record
• GitHub Security Advisory GHSA-h7mg-cq63-vhpq
• Hono Patch Commit 8a103aa59bcfbffd5396b1548a0dff3688777c36
• Hono Release v4.13.16
• CVE Project cvelistV5 JSON Record
• National Vulnerability Database (NVD) - CVE-2026-126358

Read the full report for CVE-2026-126358 on our website for more details including interactive diagrams and full exploit analysis.