`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix.
MediumGHSA-4m76-xfj5-79751 Nov · today
Does it affect you?
0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.Maintainer advisory
Timeline
1 Nov20 hahead of the GitHub database so far
- Published by the maintainer in honojs/hono1 Nov, 02:33 UTC
- Seen by Patchwire +25 min1 Nov, 02:58 UTC
- Not in the GitHub database 20 h later1 Nov, 22:47 UTC
hono4.13.16
Versions of hono
4.x
safe 4.13.16
AffectedSafe
Related alerts(6)
Same packagesExploitable only if · read by Claude, the source remains the reference
- Application relies on the csrf() middleware as its CSRF protection.
- Application exposes state-changing POST endpoints whose effect does not depend on the request body (selected by path or query string).
- Session cookie is sent cross-site: set with SameSite=None, or the attacker controls a same-site origin (cookie not SameSite=Strict).
- Victim uses Chrome or Edge (hyperlink auditing enabled) while logged in.
- Affected
- hono <4.13.16
- Fixed in
- 4.13.16
- ID
- GHSA-46wx-v44x-9hh2
Exploitable only if · read by Claude, the source remains the reference
- Application uses Hono's validator('form') middleware.
- Application accepts multipart/form-data requests on routes guarded by validator('form').
- The validator('form') callback does not fail when given an empty object.
- Application relies on validator('form') to reject, restrict, or require form fields.
- The handler reads submitted fields via c.req.parseBody() or c.req.formData().
- Affected
- hono >=4.5.1 <=4.13.15
- Fixed in
- 4.13.16
- ID
- GHSA-4h7h-rv7c-7m2v
Exploitable only if · read by Claude, the source remains the reference
- Application uses Hono's RegExpRouter, directly or through the default SmartRouter.
- Application relies on wildcard middleware for authentication or authorization.
- Routes match an affected case: middleware with an explicit default parameter pattern (e.g. /api/:tenant{[^/]+}/admin/*) on a plain-parameter route (4.13.0+); middleware on /admin/* with a route on /admin (4.1.4+); or requests with encoded line terminators (4.4.0+).
- Affected
- hono >=4.1.4 <=4.13.15
- Fixed in
- 4.13.16
- ID
- GHSA-h7mg-cq63-vhpq
Exploitable only if · read by Claude, the source remains the reference
- Uses the css helper from hono/css with server-side rendering.
- A css template has < as the last character before an interpolation, either written in the template or supplied by a preceding interpolated value.
- The interpolated value following the < is controlled by a client (untrusted input).
- Affected
- hono >=3.12.0 <=4.13.15
- Fixed in
- 4.13.16
- ID
- GHSA-3gg2-335m-rxc6
Exploitable only if · read by Claude, the source remains the reference
- Uses hono/jsx for server-side rendering.
- Renders an attacker-controlled plain string directly as a child or fallback of Suspense or ErrorBoundary (ErrorBoundary with an asynchronous sibling), as the only child of a Context.Provider, or as the root value of renderToString()/renderToReadableStream() from hono/jsx/dom/server.
- The untrusted string is not wrapped in an element and not produced via raw() or the html helper.
- Affected
- hono <4.13.7
- Fixed in
- 4.13.7
- ID
- GHSA-hxh3-vqpv-xpqv
Exploitable only if · read by Claude, the source remains the reference
- Application uses Hono's serveStatic to serve files from a directory.
- Middleware (e.g., an authentication check) is mounted on a path prefix that is part of the directory served by serveStatic.
- Static files under that middleware-protected prefix are not meant to be public.
- Affected
- hono >=4.12.4 <4.13.11
- Fixed in
- 4.13.11
- ID
- GHSA-5r4p-p66f-jhc7