PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47676 honojs CVE debrief

## Summary Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.

Vendor
honojs
Product
hono
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Hono-based web applications using app.mount() with sub-applications, particularly those handling internationalized URLs or percent-encoded path segments

Technical summary

The vulnerability stems from an inconsistency between how app.mount() processes URL pathnames versus how route matching operates. The mount prefix stripping uses raw URL pathname while route matching uses percent-decoded paths. When percent-encoded multi-byte characters are present, this causes positional misalignment during prefix removal, leading to incorrect path propagation to mounted sub-applications. This can result in routing errors or unexpected behavior in applications relying on path-based logic in sub-applications.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Hono to version 4.12.21 or later to remediate the path handling inconsistency in app.mount()
  • Review applications using app.mount() with sub-applications to verify correct path routing behavior, particularly for requests containing percent-encoded multi-byte characters
  • Validate that mounted sub-applications receive expected paths when processing internationalized or encoded URL segments

Evidence notes

CVE published 2026-05-28. Advisory references GitHub Security Advisory GHSA-2gcr-mfcq-wcc3. CVSS 5.3 (MEDIUM). CWE-444 (HTTP Request/Response Smuggling) and CWE-693 (Protection Mechanism Failure) identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47676 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47676

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47676 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47676

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.