CVE-2026-126358: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

Summary RegExpRouter, which the default SmartRouter selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it: 1. Middleware whose parameter is written with the explicit default pattern, such as /api/:tenant^/+/admin...

GHSA-H7MG-CQ63-VHPQ Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

Summary RegExpRouter, which the default SmartRouter selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it: 1. Middleware whose parameter is written with the explicit default pattern, such as /api/:tenant^/+/admin...

npm: Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

npm: Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator vulnerability discovered by ? in WordPress npm hono versions = 4.1.4, = 4.13.15...

CVE-2026-126358

The Hono web framework (versions 4.1.4 through 4.13.16) contains a vulnerability in RegExpRouter where it skips wildcard middleware in specific scenarios. Specifically, middleware is bypassed for routes matching /api/:tenant{[^/]+}/admin/* if written as /api/:tenant/admin/:id (since 4.13.0), for ...

EUVD-2026-124739

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

CVE-2026-126358 Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

PT-2026-146080

Summary RegExpRouter, which the default SmartRouter selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it: 1. Middleware whose parameter is written with the explicit default pattern, such as /api/:tenant^/+/admin...

Named path parameters can be overridden in TrieRouter

Impact The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matche...

Improper Control of Generation of Code ('Code Injection')

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Improper Control of Generation of Code 'Code Injection' due to the use of TrieRouter or when matching patterns not supported by the default RegExpRouter. An attacker can...

Design/Logic Flaw

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources...