---
id: "GHSA-h25j-2p75-qj33"
page: "https://infrastack.ai/live/GHSA-h25j-2p75-qj33"
kind: "vulnerability"
aliases: ["GHSA-h25j-2p75-qj33"]
title: "`mount()` and `app.mount()` forward a wrong path when a custom `getPath` adds a prefix, bypassing middleware scoped inside the mount prefix"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hono", "fixed": ["4.13.18"], "affected": ">= 4.13.16, <= 4.13.17", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["bun", "cloudflare-workers", "cwe-288", "deno", "hono", "host-based-routing", "node", "package"]
not_affected_if: ["no-mount", "no-path-scoped-middleware", "standard-getpath", "versions-outside-4.13.16-4.13.17"]
published_at: "2026-11-11T08:55:11+00:00"
first_seen_at: "2026-11-11T08:59:08+00:00"
updated_at: "2026-11-11T09:01:18+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/honojs/hono/security/advisories/GHSA-h25j-2p75-qj33", "first_seen_at": "2026-11-11T08:59:08+00:00"}]
exploit_sources: []
---

# `mount()` and `app.mount()` forward a wrong path when a custom `getPath` adds a prefix, bypassing middleware scoped inside the mount prefix

Link for people: https://infrastack.ai/live/GHSA-h25j-2p75-qj33 (this .md is for agents)

Hono's mount() and app.mount() forward a wrong path when a custom getPath adds a prefix, so the mounted app sees a different path than the outer app routed. An unauthenticated client can reach mounted routes that the outer app's path-scoped middleware was meant to protect.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:hono affected >= 4.13.16, <= 4.13.17 fixed 4.13.18

## How to check

- Check the installed version with `npm ls hono`; affected versions are `4.13.16` and `4.13.17`.
- Search the codebase for `getPath` and `mount(` to see whether a custom getPath that prepends a prefix (such as a host name) is combined with mounted sub-apps.
- Confirm whether auth or authorization middleware is registered on a sub-path inside a mount prefix.

## Fix

- `hono` `4.13.18`

## Timeline

- 2026-11-11T08:59:08+00:00 ghsa-repo https://github.com/honojs/hono/security/advisories/GHSA-h25j-2p75-qj33

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/honojs/hono/security/advisories/GHSA-h25j-2p75-qj33

## From the sources

### Summary

The fix for GHSA-4m76-xfj5-7975 in 4.13.16 made `mount()` and `app.mount()` remove the mount prefix from the raw request path by counting the segments of the routed path. When a custom `getPath` adds a prefix to the routed path, for example the host name for host-based routing, the routed path has more segments than the raw path, and one segment too many is removed. The mounted application then receives a different path from the one the outer application routed and protected.

### Details

With `getPath` returning `/<host>/<path>` and a mount on `/<host>`, a request for `/admin/secret` reached the mounted application as `/secret`, and a request for `/public/admin/secret` reached it as `/admin/secret`. The outer application routed on `/<host>/public/admin/secret`, so middleware registered on `/<host>/admin/*` did not run, while the mounted application served its `/admin/secret` route.

The forwarded path is now taken from the routed path (`c.req.path`) with the matched prefix removed, so the outer and the mounted application always see the same path. Because the routed path is decoded, the middleware checks that turning it back into a URL does not change its meaning, and responds with 400 otherwise: encoded dot segments, repeated trailing slashes under `strict: false` that a mounted Hono application would strip again, a request URL whose authority contains `?`, `#` or `\`, and percent escapes that do not survive re-parsing. A mount path with an optional regular expression parameter such as `/:id{[0-9]+}?` is not supported and throws; register `/mount` and `/mount/:id{[0-9]+}` separately.

The original percent encoding of the forwarded path is not preserved, for example `%41` can become `A`. Standard `getPath` is unaffected apart from this.

### Impact

An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware, when the application uses a custom `getPath` that prepends a prefix to the path.

This issue affects applications on 4.13.16 and 4.13.17 that use `mount()` or `app.mount()` together with a custom `getPath` that adds a prefix, and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_