Threats tagged 'ghsa-4m76-xfj5-7975'

Hono versions prior to 4.13.16 have a vulnerability in the mount() and app.mount() functions where crafted request paths can bypass middleware scoped inside the mount prefix. This allows unauthenticated clients to access routes in the mounted application that should be protected by path-scoped middleware such as authentication checks. The issue arises from incorrect path prefix removal and re-normalization of the forwarded path, enabling path traversal or prefix manipulation attacks. The vulnerability is fixed in version 4.13.16.