# CVE-2026-126358: Hono RegExpRouter middleware bypass via wildcard matching

Source: https://junglewise.ai/threats/cve-2026-126358-hono-regexprouter-skips-wildcard-middleware-for-some-route-sets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126358 · Severity: medium · CVSS 5.3 · Published 2026-11-13

Hono's default routing component sometimes skips authentication and authorization middleware for certain URL patterns and encoded paths. An attacker can access protected route handlers without passing the security checks that should apply to them, potentially gaining unauthorized access to sensitive functionality.

Technologies: [Hono](https://junglewise.ai/threats/technologies/hono-hono), [hono (npm)](https://junglewise.ai/threats/technologies/hono). Vendors: [Hono](https://junglewise.ai/threats/vendors/hono), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126358 being exploited in the wild.

**How severe is CVE-2026-126358?** Medium severity, with a CVSS score of 5.3, published 13 November 2026.

**Which products and versions are affected?** Hono 4.1.4 to 4.13.0 and later; hono (npm) >= 4.1.4, <= 4.13.15, SEMVER:introduced=4.1.4,fixed=4.13.16.

**Is there a fix for CVE-2026-126358?** Yes. hono (npm): upgrade to 4.13.16 or later. Until then: Use TrieRouter, LinearRouter, or PatternRouter instead of RegExpRouter by instantiating Hono with `new Hono({ router: new TrieRouter() })` until a fix is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126358 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126358?** Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hono (npm): upgrade to 4.13.16 or later

  ```sh
  npm install hono@4.13.16
  ```


Use TrieRouter, LinearRouter, or PatternRouter instead of RegExpRouter by instantiating Hono with `new Hono({ router: new TrieRouter() })` until a fix is deployed.

## Technical details

RegExpRouter in Hono's SmartRouter fails to apply wildcard middleware in three scenarios: explicit default parameter patterns, static route wildcards, and paths containing encoded line terminators. This allows unauthenticated requests to reach protected handlers that rely on wildcard-based middleware authentication or authorization without triggering the protective middleware.

## Affected products

- Hono Hono 4.1.4 to 4.13.0 and later

## Identifiers

- CVE-2026-126358
- GHSA-h7mg-cq63-vhpq

## Timeline

- 2026-11-12: disclosed

## Related threats

- [Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection](https://junglewise.ai/threats/cve-2026-126359-hono-css-helper-does-not-escape-a-closing-tag-split-between-the)
- [Hono mount() path traversal bypasses middleware scoping](https://junglewise.ai/threats/cve-2026-126357-hono-mount-and-app-mount-can-forward-a-path-that-bypasses)
- [Hono validator form multipart/form-data parameter bypass](https://junglewise.ai/threats/cve-2026-126356-hono-validator-form-skips-validation-for-multipart-form-data)
- [Hono csrf() middleware bypass via hyperlink auditing](https://junglewise.ai/threats/cve-2026-126355-hono-csrf-does-not-check-requests-sent-by-hyperlink-auditing)
- [Hono serveStatic authorization bypass via double percent-decoding](https://junglewise.ai/threats/cve-2026-111757-hono-is-a-web-application-framework-that-provides-support-for)