Named path parameters can be overridden in TrieRouter
Impact
The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources.
TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.
The code to reproduce it. The server side application:
import { Hono } from 'hono'
import { TrieRouter } from 'hono/router/trie-router'
const wait = async (ms: number) => {
return new Promise((resolve) => {
setTimeout(resolve, ms)
})
}
const app = new Hono({ router: new TrieRouter() })
app.use('*', async (c, next) => {
await wait(Math.random() * 200)
return next()
})
app.get('/modules/:id/versions/:version', async (c) => {
const id = c.req.param('id')
const version = c.req.param('version')
console.log('path', c.req.path)
console.log('version', version)
return c.json({
id,
version,
})
})
export default app
The client code which makes requests to the server application:
const examples = [
'http://localhost:8787/modules/first/versions/first',
'http://localhost:8787/modules/second/versions/second',
'http://localhost:8787/modules/third/versions/third',
]
const test = () => {
for (const example of examples) {
fetch(example)
.then((response) => response.json())
.then((data) => {
const splitted = example.split('/')
const expected = splitted[splitted.length - 1]
if (expected !== data.version) {
console.error(`Error: exprected ${expected} but got ${data.version} - url was ${example}`)
}
})
}
}
test()
The results:
Error: exprected second but got third - url was http://localhost:8787/modules/second/versions/second
Error: exprected first but got third - url was http://localhost:8787/modules/first/versions/first
Patches
"v3.11.7" includes the change to fix this issue.
Workarounds
Don't use TrieRouter directly.
// DON'T USE TrieRouter
import { TrieRouter } from 'hono/router/trie-router'
const app = new Hono({ router: new TrieRouter() })
References
Router options on the Hono website: https://hono.dev/api/hono#router-option
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | hono | < 3.11.7 | 3.11.7 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L- Weakness (CWE)
CWE-94- Platform
- npm
- Package
hono- Disclosed
- 15.12.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f6gv-hh8j-q8vq - CC BY 4.0
Vulnerability history: hono
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 52
- First → latest
- 12.2023 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 4
Disclosures per year
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Named path parameters can be overridden in TrieRouter this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.