CVE-2026-126357

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route while the outer application routes the original path. Since 4.12.21, rebuilding the forwarded URL from the decoded pathname can also convert a decoded backslash to a slash and collapse parent-directory segments, again causing the mounted application to receive a protected path. An unauthenticated client can use either applicable path transformation to reach a mounted route without authentication or authorization middleware scoped to a subpath inside the mount prefix. This issue is fixed in version 4.13.16.

• CWE-288

• https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6
• https://github.com/honojs/hono/releases/tag/v4.13.16
• https://github.com/honojs/hono/security/advisories/GHSA-4m76-xfj5-7975

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126351Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126352Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126358Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126359Hono is a Web application framework that provides support fo…3.4
• CVE-2026-126360OpenTelemetry Python provides the Python API and SDK for Ope…5.3
• CVE-2026-126361Astro is a web framework for content-driven websites. Prior …2.3
• CVE-2026-126362Astro is a web framework for content-driven websites. From 5…2.3
• CVE-2026-126363Astro is a web framework for content-driven websites. From 0…2.3