CVE-2026-47676

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier tiempo de ejecución de JavaScript. Antes de la versión 4.12.21, app.mount() elimina el prefijo de montaje de la ruta de la solicitud entrante utilizando el nombre de ruta URL sin procesar, mientras que la coincidencia de rutas se realiza contra la ruta decodificada por porcentaje. Esta inconsistencia provoca que el prefijo se elimine en la posición incorrecta cuando la ruta contiene caracteres multibyte codificados por porcentaje, lo que resulta en que la subaplicación montada reciba una ruta incorrecta. Esta vulnerabilidad se corrige en la versión 4.12.21.

Information

Published : 2026-05-28 17:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-47676

Mitre link : CVE-2026-47676

CVE.ORG link : CVE-2026-47676

JSON object : View

Products Affected

hono

hono

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-47676", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47676", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:12:23.714948Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.21"}]}]}], "published": "2026-05-28T17:16:32.697", "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier tiempo de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.12.21, app.mount() elimina el prefijo de montaje de la ruta de la solicitud entrante utilizando el nombre de ruta URL sin procesar, mientras que la coincidencia de rutas se realiza contra la ruta decodificada por porcentaje. Esta inconsistencia provoca que el prefijo se elimine en la posici\u00f3n incorrecta cuando la ruta contiene caracteres multibyte codificados por porcentaje, lo que resulta en que la subaplicaci\u00f3n montada reciba una ruta incorrecta. Esta vulnerabilidad se corrige en la versi\u00f3n 4.12.21."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "797B2A25-4B24-46A9-8EF4-35F6F1214A7C", "versionEndExcluding": "4.12.21"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}