GHSA-4m76-xfj5-7975: Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
Summary
mount() and app.mount() remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on /app/admin/. The outer application routes on the original path, so the middleware does not run.
Details
1. Dynamic prefix (all affected versions): for a mount such as /api/:tenant/, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so /api/a/xxxxx/admin/secret reaches the mounted application as /admin/secret. 2. Re-normalization (since 4.12.21): the forwarded path was built from the decoded request path and assigned to url.pathname, which turns a decoded backslash into / and collapses ... /app/public%5C..%5Cadmin/secret reaches the mounted application as /admin/secret.
The fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as /assets. A trailing slash in an app.mount() prefix no longer removes an extra segment.
Impact
An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.
This affects applications that use mount() or app.mount() and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.
Workarounds
Register the authentication middleware inside the mounted application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/honoto a version that resolves this vulnerability.Fixed in 4.13.16 - Compensating control
Register authentication middleware inside the mounted application for applications using Hono mount() or app.mount(), especially for routes protected by path-scoped middleware such as /app/admin/*.
Event History
Frequently Asked Questions
Which application designs are exposed to this issue?
Applications that mount another Hono application and rely on path-scoped middleware in the outer application to protect routes inside that mount are exposed. Examples include authentication middleware scoped to a path such as /app/admin/* while the mounted application serves the corresponding admin route.
What does an attacker need to exploit the bypass?
The attacker needs only to send a crafted network request; the supplied vector indicates no privileges or user interaction are required. Exploitation depends on a mount configuration and outer path-scoped middleware whose protected route can be reached after the forwarded path is altered.
Are static mount prefixes affected as well as dynamic ones?
Dynamic prefixes such as /api/:tenant/* are affected by incorrect prefix removal in all affected versions. A separate re-normalization issue affects forwarded paths since version 4.12.21 and can use encoded backslashes and traversal segments to reach a protected path.