{"metadata": {"vulnerability": "CVE-2026-126358", "count": 10, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 4}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-10T21:12:01.227Z", "date_only": false, "value": "2026-11-10T21:12:01.227Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-126358", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T22:26:00.882Z", "date_only": false, "value": "2026-11-12T22:26:00.882214Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117605817407246017", "record": "CVE-2026-126358", "field": "creation_timestamp", "uuid": "81541e15-5f96-43a7-bf46-09aab075970d", "content": "CVE-2026-126358 Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126358https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpqhttps://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36https://github.com/honojs/hono/releases/tag/v4.13.16#honojs #hono#CVE_2026_126358#bot", "url": "https://infosec.exchange/users/cve/statuses/117605817407246017"}, {"timestamp": "2026-11-12T23:23:30Z", "date_only": false, "value": "2026-11-12T23:23:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H7MG-CQ63-VHPQ", "record": "GHSA-H7MG-CQ63-VHPQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T23:23:30Z", "date_only": false, "value": "2026-11-12T23:23:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H7MG-CQ63-VHPQ", "record": "GHSA-H7MG-CQ63-VHPQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T00:20:11.050Z", "date_only": false, "value": "2026-11-13T00:20:11.050", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-126358", "record": "FKIE_CVE-2026-126358", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T00:20:11.200Z", "date_only": false, "value": "2026-11-13T00:20:11.200", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-126358", "record": "FKIE_CVE-2026-126358", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-13T15:30:52Z", "date_only": false, "value": "2026-11-13T15:30:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/2afe444f812027aa7dc07fc98e57da81", "record": "CVE-2026-126358", "field": "creation_timestamp", "uuid": "93a58e25-eae7-4153-8953-a7470761a9a2", "content": "# CVE-2026-126358: CVE-2026-126358: Authorization Bypass via Wildcard Middleware Omission in Hono RegExpRouter\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-11-12\n> **Full Report:** https://cvereports.com/reports/CVE-2026-126358\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) exists in the Hono web application framework (npm package `hono`) from version 4.1.4 prior to 4.13.16. Flaws in the registration-time coverage calculation and regular expression compilation within `RegExpRouter` cause wildcard middleware to be omitted under three specific routing conditions: parameter pattern equivalence mismatches, wildcard boundary collisions, and request paths containing percent-encoded line terminators. Because Hono's default `SmartRouter` selects `RegExpRouter` for most standard web applications, unauthenticated remote clients can bypass authentication, authorization, or security middleware registered on wildcard paths to directly access protected route handlers or the application's not-found handler.\n\n## TL;DR\nHono versions 4.1.4 through 4.13.15 contain flaws in `RegExpRouter` that cause wildcard middleware to be skipped when mixing explicit regex parameter syntax with shorthand syntax, combining `/path/*` middleware with `/path*` routes, or processing request paths containing encoded line terminators (`%0A`, `%0D`, `%E2%80%A8`, `%E2%80%A9`). Upgrading to Hono 4.13.16 resolves all three bypass vectors.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-126358 (GHSA-h7mg-cq63-vhpq)\n- **Vulnerability Class**: CWE-863: Incorrect Authorization\n- **Affected Component**: Hono RegExpRouter (npm: hono >= 4.1.4, < 4.13.16)\n- **CVSS v3.1 Score**: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n- **EPSS Score**: 0.35% (28.76th Percentile)\n- **Attack Vector**: Unauthenticated Network HTTP Request\n- **Exploit Status**: Proof-of-Concept (Unit test reproduction available)\n- **Patched Version**: hono v4.13.16\n\n## Affected Systems\n\n- Hono Web Application Framework (npm package: hono)\n- **hono**: >= 4.1.4, < 4.13.16 (Fixed in: `4.13.16`)\n\n## Mitigation\n\n- Upgrade the `hono` package to version 4.13.16 or later to incorporate the structural trie coverage calculation and `[^]*` wildcard compilation fixes.\n- Explicitly configure Hono applications to use `TrieRouter`, `LinearRouter`, or `PatternRouter` instead of the default `SmartRouter` (`RegExpRouter`) if upgrading is not immediately possible.\n- Standardize route parameter definitions across middleware and route handlers by avoiding mixed usage of `:param{[^/]+}` and `:param`, and avoid combining `/prefix/*` middleware with `/prefix*` routes.\n- Deploy edge proxy or WAF filtering rules to reject incoming HTTP requests containing percent-encoded line terminators (`%0A`, `%0D`, `%E2%80%A8`, `%E2%80%A9`) in the URI path.\n\n**Remediation Steps:**\n1. Identify all projects and microservices using the `hono` package within the affected range (`>= 4.1.4, < 4.13.16`).\n2. Run `npm install hono@latest` (or the equivalent command for pnpm, yarn, or bun) to update `hono` to version `4.13.16` or higher.\n3. Audit application routing definitions for any instances where `app.use('/path/*')` pairs with `app.all('/path*')` or where explicit parameter regexes (`:param{[^/]+}`) mix with bare parameters (`:param`).\n4. Add regression tests to the application's test suite verifying that unauthenticated requests to protected routes and requests containing `%0A` in the path return `401 Unauthorized` or `403 Forbidden` as expected.\n5. Redeploy the updated application bundles to production environments (Cloudflare Workers, Node.js containers, Deno Deploy, or Bun servers).\n\n## References\n\n- [CVE-2026-126358 Official CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-126358)\n- [GitHub Security Advisory GHSA-h7mg-cq63-vhpq](https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpq)\n- [Hono Patch Commit 8a103aa59bcfbffd5396b1548a0dff3688777c36](https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36)\n- [Hono Release v4.13.16](https://github.com/honojs/hono/releases/tag/v4.13.16)\n- [CVE Project cvelistV5 JSON Record](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126358.json)\n- [National Vulnerability Database (NVD) - CVE-2026-126358](https://nvd.nist.gov/vuln/detail/CVE-2026-126358)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-126358) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/2afe444f812027aa7dc07fc98e57da81"}], "metrics": {"as_of": "2026-11-13T21:08:55.482Z", "anchors": {"origin": {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 82067.369227, "hours": 22.796491451944444, "days": 0.9498538104976852, "min_seconds": 82067.369227, "max_seconds": 82067.369227, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T22:21:08.113Z", "date_only": false, "value": "2026-11-12T22:21:08.113Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126358", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T21:08:55.482Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}