CVE-2026-47676
Last modified
CVE-2026-47676 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hono | Hono | < 4.12.21 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-47676?
How severe is CVE-2026-47676?
How do I fix CVE-2026-47676?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47670DbGate is cross-platform database manager. Versions 7.1.8 an…9.4
- CVE-2026-47671Nhost is an open source Firebase alternative with GraphQL. I…5.4
- CVE-2026-47672epa4all-client is the Java Client for epa4all / ePA 3.0 in t…6.5
- CVE-2026-47673Hono is a Web application framework that provides support fo…6.5
- CVE-2026-47674Hono is a Web application framework that provides support fo…5.3
- CVE-2026-47675Hono is a Web application framework that provides support fo…5.3
- CVE-2026-47682CVAT is an open source interactive video and image annotatio…7.1
- CVE-2026-47684Sync-in Server is a secure, open-source platform for file st…7.7
- CVE-2026-47685FOG is a free open-source cloning/imaging/rescue suite/inven…8.7
- CVE-2026-47687FOG is a free open-source cloning/imaging/rescue suite/inven…8.7
- CVE-2026-47688FOG is a free open-source cloning/imaging/rescue suite/inven…8.2
- CVE-2026-47689FOG is a free open-source cloning/imaging/rescue suite/inven…5.2
Are you affected by CVE-2026-47676?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST