Hono CVE-2026-47676

Exploitation requires the target application to use Hono's app.mount() API to mount at least one sub-application at a path prefix. The attacker must send a URL containing percent-encoded multi-byte UTF-8 characters within the mount prefix segment to trigger the byte-boundary misalignment. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated privileges, and no user interaction are required - this is exploitable against any network-accessible Hono instance using app.mount() running a version prior to 4.12.21. Exploitation is limited in practice to applications where the mounted sub-application exposes sensitive routes or data without its own independent authentication layer; if sub-applications enforce authentication internally, the path misrouting may reach an endpoint but still be blocked by auth checks. Non-default configurations are not required - app.mount() is a core, commonly used API.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-accessible, low-complexity, fully unauthenticated attack with limited but real confidentiality impact and no integrity or availability consequences. The zero-authentication, zero-user-interaction requirement is the most significant risk amplifier - any network-reachable Hono application using app.mount() is theoretically exposed without requiring an account or session. The 'Request Smuggling' tag elevates concern beyond simple misconfiguration, as it signals an actively exploitable parser-level inconsistency. EPSS data was not provided in the source intelligence, so a quantitative exploitation probability cannot be stated. This is not listed in CISA KEV, and no public POC has been identified, suggesting opportunistic mass exploitation is not yet occurring. Real-world impact is deployment-dependent: applications that rely solely on app.mount() path prefixes for security boundaries (e.g., admin panels mounted at /admin without independent auth middleware) face higher practical risk than those with defense-in-depth authentication at the sub-application level. This is not a 'high-CVSS-but-low-real-risk' case - the CVSS score is moderate and the risk profile aligns with it. Priority should be determined by whether path-prefix routing in the application carries any security significance.

An attacker identifies a Hono application that mounts a sensitive sub-application (e.g., an admin API) at a path prefix such as /admin, where access control depends on the path prefix not being reachable from other routes. The attacker crafts an HTTP request with a URL containing percent-encoded multi-byte characters within the prefix segment - for example, encoding a character that spans two bytes as %XX%XX - causing the prefix-stripping logic to remove fewer or more characters than intended. The sub-application receives a shifted path, potentially matching an unintended route and returning data or functionality that should not be accessible from the public-facing application path. No public POC has been identified, but the attack requires only a crafted HTTP GET request with no authentication or user interaction.