CVE-2026-56761: hono - HTML Injection via Improper JSX Attribute Name Handling in SSR

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-79

Description

hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.

Affected products

honojs hono: before 4.12.14 — fixed in 4.12.14

How to fix

Upgrade to a fixed version: honojs hono 4.12.14. Check the vendor advisory for mitigations.

References

https://github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375
https://www.vulncheck.com/advisories/hono-html-injection-via-improper-jsx-attribute-name-handling-in-ssr

Get alerted when CVE-2026-56761 or the next vulnerability affects your stack