CVE-2026-47676

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

State: Published
Severity: 5.3 Medium
Published: May 28, 2026
Updated: May 28, 2026
Reserved: May 19, 2026

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
honohonojs	< 4.12.21Affected

References

https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.