SB20261110270 - Multiple vulnerabilities in hono

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110270

SB20261110270 - Multiple vulnerabilities in hono

Published: November 10, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261110270
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2026-126355)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger unauthorized state changes in applications where endpoint actions do not depend on the request body.

The vulnerability exists due to incomplete cross-site request forgery validation in Hono's csrf() middleware when handling text/ping requests, which bypass Origin and Sec-Fetch-Site checks. A remote attacker can trick a logged-in Chrome or Edge user into clicking an <a ping> hyperlink on a malicious page to trigger a state-changing cross-origin POST when the browser sends the user's cookies.


2) Input validation error (CVE-ID: CVE-2026-126356)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass form validation and submit fields the application intended to reject.

The vulnerability exists due to improper input validation in Hono's validator('form') middleware when strict Content-Type matching rejects multipart/form-data headers with additional parameters or whitespace, passing an empty object to validation instead. A remote attacker can send such requests to bypass field checks and deliver unvalidated fields to handlers if the validation callback accepts an empty object.


3) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-126357)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication middleware and access protected information in a mounted application.

The vulnerability exists due to incorrect dynamic-prefix length calculation and re-normalization of decoded paths in Hono's mount() and app.mount() when forwarding requests to mounted applications. A remote attacker can request /api/a/xxxxx/admin/secret under a /api/:tenant/* mount or /app/public%5C..%5Cadmin/secret under an /app mount to reach /admin/secret without triggering the outer application's path-scoped authentication middleware.


4) Incorrect authorization (CVE-ID: CVE-2026-126358)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication or authorization middleware and access protected handlers, potentially disclosing sensitive information.

The vulnerability exists due to incorrect authorization in Hono's RegExpRouter when wildcard middleware coverage misclassifies equivalent route patterns or fails to match line terminators. A remote attacker can request routes with mismatched patterns (/api/:tenant{[^/]+}/admin/* versus /api/:tenant/admin/:id or /admin/* versus /admin*) or paths containing %0A, %0D, %E2%80%A8, or %E2%80%A9 to reach route or not-found handlers without the registered middleware.


5) Cross-site scripting (CVE-ID: CVE-2026-126359)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to disclose information available to a rendered page through injected browser script.

The vulnerability exists due to improper neutralization of closing tags across template boundaries in the hono/css css helper when joining individually escaped values with preceding text ending in <. A remote attacker can supply an interpolated value beginning with /style> followed by malicious HTML to produce </style>, close the style element early, and execute script that exposes page information when a user views the server-rendered page.


Remediation

Install update from vendor's website.

References