Executive brief
Hono, a web framework for building HTTP APIs and web applications, contains a routing bug in its app.mount() function that affects applications using percent-encoded characters in URLs. When a mounted sub-application receives requests with encoded non-ASCII characters, the framework incorrectly strips the mount prefix, causing requests to be routed to unintended handlers. This could allow an attacker to bypass middleware or access routes that should not be publicly accessible through the mounted path.
Technical details
The vulnerability exists in Hono's app.mount() function, which is used to register sub-applications at a specific path prefix. The root cause is an inconsistency in how prefix stripping is applied: Hono calculates the number of characters to strip based on the decoded (percent-decoded) mount prefix length, but then applies that character count as a slice offset to the raw URL pathname without decoding it first. When a URL contains percent-encoded characters that expand to fewer characters when decoded (e.g., encoded non-ASCII UTF-8 sequences), the decoded and raw representations have different byte lengths, causing the prefix to be stripped at the wrong position. This results in the mounted sub-application receiving a partial or garbled path instead of the correctly-stripped path. The vulnerability is reachable over the network without authentication or user interaction, affecting any Hono application using app.mount() with paths containing percent-encoded characters. An attacker can craft URLs with percent-encoded characters to reach unintended route handlers or bypass middleware. The issue has been patched in version 4.12.21.
Affected products
- Hono Hono < 4.12.21
Timeline
- 2026-05-19: disclosed: Advisory GHSA-2gcr-mfcq-wcc3 published
- 2026-05-19: patched: Fixed in version 4.12.21
- 2026-06-04: advisory: Published to OSV database