Is CVE-2026-126358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126358 being exploited in the wild.

How severe is CVE-2026-126358?

Medium severity, with a CVSS score of 5.3, published 13 November 2026.

Which products and versions are affected?

Hono 4.1.4 to 4.13.0 and later; hono (npm) >= 4.1.4, <= 4.13.15, SEMVER:introduced=4.1.4,fixed=4.13.16.

How is CVE-2026-126358 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126358?

Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matching

Q: Is there a fix for CVE-2026-126358?

Yes. hono (npm): upgrade to 4.13.16 or later. Until then: Use TrieRouter, LinearRouter, or PatternRouter instead of RegExpRouter by instantiating Hono with `new Hono({ router: new TrieRouter() })` until a fix is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126358 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-126358?

Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126358 · Severity: medium · CVSS 5.3 · Published 2026-11-13

Hono's default routing component sometimes skips authentication and authorization middleware for certain URL patterns and encoded paths. An attacker can access protected route handlers without passing the security checks that should apply to them, potentially gaining unauthorized access to sensitive functionality.

Technologies: Hono, hono (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-126358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126358 being exploited in the wild.
How severe is CVE-2026-126358?: Medium severity, with a CVSS score of 5.3, published 13 November 2026.
Which products and versions are affected?: Hono 4.1.4 to 4.13.0 and later; hono (npm) >= 4.1.4, <= 4.13.15, SEMVER:introduced=4.1.4,fixed=4.13.16.
Is there a fix for CVE-2026-126358?: Yes. hono (npm): upgrade to 4.13.16 or later. Until then: Use TrieRouter, LinearRouter, or PatternRouter instead of RegExpRouter by instantiating Hono with `new Hono({ router: new TrieRouter() })` until a fix is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126358 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126358?: Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hono (npm): upgrade to 4.13.16 or later
```
npm install hono@4.13.16
```

Use TrieRouter, LinearRouter, or PatternRouter instead of RegExpRouter by instantiating Hono with `new Hono({ router: new TrieRouter() })` until a fix is deployed.

Technical details

RegExpRouter in Hono's SmartRouter fails to apply wildcard middleware in three scenarios: explicit default parameter patterns, static route wildcards, and paths containing encoded line terminators. This allows unauthenticated requests to reach protected handlers that rely on wildcard-based middleware authentication or authorization without triggering the protective middleware.

Affected products

Hono Hono 4.1.4 to 4.13.0 and later

Identifiers

CVE-2026-126358
GHSA-h7mg-cq63-vhpq

Timeline

2026-11-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.