CVE WatchNov 13, 2026

CVE-2026-126357

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 13, 2026 · Last modified: Nov 13, 2026 · CWE-288

EPSS · 30d

Not enough EPSS history yet.

Technical description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route while the outer application routes the original path. Since 4.12.21, rebuilding the forwarded URL from the decoded pathname can also convert a decoded backslash to a slash and collapse parent-directory segments, again causing the mounted application to receive a protected path. An unauthenticated client can use either applicable path transformation to reach a mounted route without authentication or authorization middleware scoped to a subpath inside the mount prefix. This issue is fixed in version 4.13.16.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-106018—

—

———Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This issue affects EasyIO FW: through 3.0b25.4h CVE-2026-125285—

—

———Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.4h CVE-2026-110003—

—

——0A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.4h CVE-2026-851018.6 HIG

—

——0An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.7h CVE-2026-185968.1 HIG

—

——0An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks.7h CVE-2026-1247385.3 MED

—

——0A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.8h