What is the CVSS score of CVE-2026-47676?

CVE-2026-47676 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-47676?

Yes, a public proof-of-concept exploit is available for CVE-2026-47676. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-47676?

Yes, a patch is available for CVE-2026-47676. Update the affected software to the latest version immediately.

Hono CVE-2026-47676

EUVD-2026-32924 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-05-28 GitHub_M

GHSA-2gcr-mfcq-wcc3

Information Disclosure Request Smuggling Hono

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:24 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on hono (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.12.21.

DescriptionGitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.

AnalysisAI

Path prefix stripping in Hono's app.mount() API exposes mounted sub-applications to incorrect routing due to a raw-vs-decoded URL path inconsistency, potentially allowing unauthenticated remote attackers to reach unintended endpoints and disclose protected information. All Hono versions prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit or CISA KEV listing exists at time of analysis; however, the CVSS vector AV:N/AC:L/PR:N/UI:N and the 'Information Disclosure / Request Smuggling' classification make this a meaningful priority for any deployment that relies on mount-prefix path logic for access segregation.

Technical ContextAI

Hono is a lightweight, multi-runtime web framework for JavaScript (Cloudflare Workers, Deno, Bun, Node.js, and others). The vulnerability is rooted in CWE-444 - Inconsistent Interpretation of HTTP Requests - a class of flaw where different layers of the same stack parse the same input differently, enabling attackers to exploit the gap. Specifically, app.mount() strips the mount prefix from an incoming request path using the raw (percent-encoded) URL pathname, but the subsequent route matching step operates against the percent-decoded version of that path. When a URL contains percent-encoded multi-byte characters (e.g., multi-byte UTF-8 sequences represented as %XX%XX), the byte-length difference between the encoded and decoded forms causes the prefix to be stripped at the wrong character boundary. The sub-application consequently receives a malformed or shifted path that does not correspond to any route the developer intended to expose, potentially bypassing path-prefix-based access controls. The affected CPE is cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*, covering all Hono versions prior to 4.12.21.

RemediationAI

Upgrade Hono to version 4.12.21 or later, which resolves the inconsistency between raw-pathname prefix stripping and percent-decoded route matching in app.mount(). This is a vendor-released patch confirmed at version 4.12.21 per the GitHub Security Advisory GHSA-2gcr-mfcq-wcc3 at https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3. If immediate upgrade is blocked, a compensating control is to enforce URL path canonicalization at the reverse proxy or WAF layer - specifically, percent-decode and then re-encode all incoming paths to a canonical form before they reach the Hono process, which eliminates the raw/decoded discrepancy. Note that this may break applications intentionally handling raw percent-encoded paths. A second mitigation is to remove reliance on app.mount() path prefixes as a security boundary entirely: add explicit authentication or authorization middleware inside each mounted sub-application so that even if a path is misrouted, the sub-app independently enforces access control. This approach is the more architecturally sound long-term posture regardless of patch status.