CVE-2026-47676: Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-47676 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →