Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path manipulation issue within the hono web framework, specifically in the app.mount() functionality. The root cause is an inconsistency in how request paths are handled. The logic calculates the length of the mount prefix from its decoded form but applies this length to slice the raw, percent-encoded URL pathname.
The fixing commit, 6cbb025ff87fca1a3d00d0ccca0eaf3a6385c3f1, clearly shows the change in src/hono-base.ts inside a function returned by the mount method. The vulnerable line url.pathname = url.pathname.slice(pathPrefixLength) || '/' is replaced with url.pathname = this.getPath(request).slice(pathPrefixLength) || '/'. This change ensures that the path is decoded before the prefix is stripped, resolving the length mismatch issue that occurs with percent-encoded characters.
When a request is made to a mounted route in a vulnerable application, the anonymous request handler created by Hono.mount is executed. This handler contains the flawed logic. Therefore, Hono.mount is the key function responsible for introducing the vulnerability. During exploitation, a runtime profiler would indicate that this handler, and by extension the Hono.mount method that configured it, is part of the execution flow that leads to incorrect routing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hono | npm | < 4.12.21 | 4.12.21 |
