{"id":"CVE-2026-47676","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T17:16:32.697","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21."},{"lang":"es","value":"Hono es un framework de aplicación web que proporciona soporte para cualquier tiempo de ejecución de JavaScript. Antes de la versión 4.12.21, app.mount() elimina el prefijo de montaje de la ruta de la solicitud entrante utilizando el nombre de ruta URL sin procesar, mientras que la coincidencia de rutas se realiza contra la ruta decodificada por porcentaje. Esta inconsistencia provoca que el prefijo se elimine en la posición incorrecta cuando la ruta contiene caracteres multibyte codificados por porcentaje, lo que resulta en que la subaplicación montada reciba una ruta incorrecta. Esta vulnerabilidad se corrige en la versión 4.12.21."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"honojs","product":"hono","versions":[{"version":"< 4.12.21","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-28T19:12:23.714948Z","id":"CVE-2026-47676","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"},{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*","versionEndExcluding":"4.12.21","matchCriteriaId":"797B2A25-4B24-46A9-8EF4-35F6F1214A7C"}]}]}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}