Incorrect authorization in hono - CVE-2026-126358
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164378
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126358
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication or authorization middleware and access protected handlers, potentially disclosing sensitive information.
The vulnerability exists due to incorrect authorization in Hono's RegExpRouter when wildcard middleware coverage misclassifies equivalent route patterns or fails to match line terminators. A remote attacker can request routes with mismatched patterns (/api/:tenant{[^/]+}/admin/* versus /api/:tenant/admin/:id or /admin/* versus /admin*) or paths containing %0A, %0D, %E2%80%A8, or %E2%80%A9 to reach route or not-found handlers without the registered middleware.
Affected software
hono
How to mitigate CVE-2026-126358
Install security update from vendor's website.
hono - update to 4.13.16