{"metadata": {"vulnerability": "cve-2026-47676", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-19T21:10:38.798Z", "date_only": false, "value": "2026-05-19T21:10:38.798Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-47676", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-28T15:26:01.672Z", "date_only": false, "value": "2026-05-28T15:26:01.672Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-47676", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-05-28T15:26:01.672Z", "date_only": false, "value": "2026-05-28T15:26:01.672Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-47676", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-28T17:16:32Z", "date_only": false, "value": "2026-05-28T17:16:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2GCR-MFCQ-WCC3", "record": "GHSA-2GCR-MFCQ-WCC3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-05-28T17:16:32.697Z", "date_only": false, "value": "2026-05-28T17:16:32.697", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47676", "record": "FKIE_CVE-2026-47676", "field": "published"}, {"timestamp": "2026-05-28T19:12:23.714Z", "date_only": false, "value": "2026-05-28T19:12:23.714948Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-47676", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-28T19:12:23.714Z", "date_only": false, "value": "2026-05-28T19:12:23.714948Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47676", "record": "FKIE_CVE-2026-47676", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-28T19:13:28.934Z", "date_only": false, "value": "2026-05-28T19:13:28.934Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-47676", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-28T19:13:28.934Z", "date_only": false, "value": "2026-05-28T19:13:28.934Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-47676", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-04T18:01:00Z", "date_only": false, "value": "2026-06-04T18:01:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2GCR-MFCQ-WCC3", "record": "GHSA-2GCR-MFCQ-WCC3", "field": "published"}, {"timestamp": "2026-06-04T18:01:00Z", "date_only": false, "value": "2026-06-04T18:01:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2GCR-MFCQ-WCC3", "record": "GHSA-2GCR-MFCQ-WCC3", "field": "modified"}, {"timestamp": "2026-06-04T18:41:16Z", "date_only": false, "value": "2026-06-04T18:41:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/9a85ace33b5f15b6d07a68897c3ce675", "record": "CVE-2026-47676", "field": "creation_timestamp", "uuid": "aa1a1ec5-992a-40b6-b4d0-ee5ad1945818", "content": "# CVE-2026-47676: CVE-2026-47676: Inconsistent Path Parsing and Slicing in Hono Framework Sub-Application Mounting\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-47676\n\n## Summary\nA path parsing and normalization inconsistency vulnerability exists in the Hono web framework prior to version 4.12.21. When hosting sub-applications via the app.mount() routing interface, Hono calculates the routing path prefix length on a percent-decoded representation of the URI but executes the path-slicing offset on the raw, percent-encoded string. This discrepancy results in malformed request paths being dispatched to mounted sub-applications, potentially leading to route bypasses, route confusion, and application-level Denial of Service.\n\n## TL;DR\nAn inconsistency between decoded prefix matching and raw path-slicing in Hono's app.mount() causes malformed path propagation and routing failures when processing percent-encoded multi-byte URI characters.\n\n## Technical Details\n\n- **CWE ID**: CWE-444 (Inconsistent Interpretation of HTTP Requests)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 5.3 Medium\n- **Exploit Status**: Proof of Concept available in test suites\n- **KEV Status**: Not listed\n- **Ransomware Use**: No known usage\n\n## Affected Systems\n\n- Hono framework web applications running on Node.js, Bun, Deno, or Cloudflare Workers\n- **hono**: < 4.12.21 (Fixed in: `4.12.21`)\n\n## Mitigation\n\n- Upgrade Hono dependencies to version 4.12.21 or higher\n- Ensure all mount prefixes are defined strictly using Unicode literals rather than percent-encoded strings\n- Implement a global catch-all exception handler to catch unhandled URIErrors resulting from malformed HTTP paths\n\n**Remediation Steps:**\n1. Identify all projects utilizing Hono by running 'npm ls hono' or equivalent package manager commands\n2. Update the project package.json to require 'hono': '^4.12.21' or higher\n3. Execute the package manager install command to apply the update ('npm install' or 'pnpm install')\n4. Review codebase usage of 'app.mount' to ensure prefixes do not contain hardcoded percent-encoded characters\n5. Re-deploy the application to production and run regression tests containing non-ASCII route characters\n\n## References\n\n- [Hono Security Advisory GHSA-2gcr-mfcq-wcc3](https://github.com/honojs/hono/security/advisories/GHSA-2gcr-mfcq-wcc3)\n- [Fix Commit 6cbb025](https://github.com/honojs/hono/commit/6cbb025ff87fca1a3d00d0ccca0eaf3a6385c3f1)\n- [CVE-2026-47676 Record](https://www.cve.org/CVERecord?id=CVE-2026-47676)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-47676) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/9a85ace33b5f15b6d07a68897c3ce675"}, {"timestamp": "2026-10-14T20:10:00.190Z", "date_only": false, "value": "2026-10-14T20:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47676", "record": "FKIE_CVE-2026-47676", "field": "lastModified"}]}