SB2026072451 - Multiple vulnerabilities in hono
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-47676)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to inconsistent interpretation of request paths in app.mount() when processing percent-encoded paths. A remote attacker can send a specially crafted request containing percent-encoded multi-byte characters to disclose sensitive information.
The issue can cause the mounted sub-application to receive an incorrectly stripped path, which may bypass middleware or route matching and reach unintended handlers within the sub-application.
2) Improper Validation of Unsafe Equivalence in Input (CVE-ID: CVE-2026-47674)
CWE-ID: CWE-1289 - Improper Validation of Unsafe Equivalence in Input
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass IP-based access controls.
The vulnerability exists due to improper validation of unsafe equivalence in input in the ip-restriction middleware when handling requests with non-canonical IPv6 source addresses against static deny rules. A remote attacker can supply a non-canonical representation of a denied IP address to bypass IP-based access controls.
This issue occurs when applications use static non-CIDR rules and the IP address source can provide non-canonical IPv6 forms, such as compressed or expanded notation, IPv4-mapped hexadecimal notation, or zone identifier suffixes.
3) HTTP response splitting (CVE-ID: CVE-2026-47675)
CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject additional attributes into a Set-Cookie response header.
The vulnerability exists due to improper neutralization of CRLF sequences in HTTP headers and improper input validation in the serialize() function in hono/cookie when processing user-controlled sameSite or priority option values. A remote attacker can supply a crafted option value to inject additional attributes into a Set-Cookie response header.
User interaction is required because exploitation occurs when an application passes user-controlled input to the sameSite or priority option of setCookie() or serialize().
4) Improper Authorization (CVE-ID: CVE-2026-47673)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization controls.
The vulnerability exists due to improper authorization in jwt and jwk middleware when processing Authorization headers. A remote attacker can supply a valid JWT under a non-bearer authorization scheme identifier to bypass authorization controls.
This issue affects deployments that rely on scheme-aware external controls, such as WAFs, API gateways, or reverse proxies, to enforce policies based on the authorization scheme identifier.
Remediation
Install update from vendor's website.