The vulnerability in honojs hono (CVE-2026-47676) involves inconsistent interpretation of HTTP request paths during the mounting of sub-applications. Specifically, app.mount() removes the mount prefix based on the raw URL pathname, but route matching is done against the percent-decoded path. When the path contains percent-encoded multi-byte characters, this inconsistency causes the prefix to be stripped incorrectly, resulting in the sub-application receiving an incorrect path. This behavior can lead to HTTP request/response smuggling issues classified under CWE-444 and CWE-693. The issue is resolved in hono version 4.12.21.

The vulnerability allows the mounted sub-application to receive an incorrect path due to inconsistent path handling. This could potentially be leveraged to cause HTTP request/response smuggling attacks, impacting confidentiality (partial information disclosure as indicated by CVSS) but not integrity or availability. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

Upgrade honojs hono to version 4.12.21 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the version fix note. No additional mitigation guidance or temporary workarounds are provided.