HONO · GHSA-4m76-xfj5-7975 · Package
FIX → 4.13.16
Hono's mount() and app.mount() strip the mount prefix incorrectly, so a crafted request reaches a route in the mounted app without passing the outer app's middleware. An unauthenticated attacker can reach routes the outer app meant to protect, such as an /app/admin/* check.
first public Nov 1, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use mount() or app.mount() and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization. Apps that enforce auth inside the mounted application, or that do not mount sub-applications, are not affected by the path bypass.
Not affected if auth-inside-mounted-app, no-mount-usage
Who cares bun, cloudflare-workers, deno, hono, node
mount( or app.mount( calls in your code and check whether auth middleware is registered on a sub-path inside the mount prefix.npm ls hono; versions below 4.13.16 are affected.Upgrade to 4.13.16
mount() and app.mount() remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on /app/admin/*. The outer application routes on the original path, so the middleware does not run.
/api/:tenant/*, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so /api/a/xxxxx/admin/secret reaches the mounted application as /admin/secret.url.pathname, which turns a decoded backslash into / and collapses ... /app/public%5C..%5Cadmin/secret reaches the mounted application as .Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
4.13.16/admin/secretThe fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as /assets*. A trailing slash in an app.mount() prefix no longer removes an extra segment.
An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.
This affects applications that use mount() or app.mount() and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.
Register the authentication middleware inside the mounted application.