Web Application Framework Vulnerability in Hono by HonoJS
CVE-2026-126359

3.4LOW

Key Information:

Vendor

Honojs

Status
Hono
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126359?

The Hono web application framework, impacting versions from 3.12.0 to 4.13.16, contains a vulnerability in its CSS helper functionality. This issue arises when interpolated string values are not properly sanitized, allowing an attacker to inject HTML or JavaScript code. Specifically, when untrusted strings appear immediately after a '<' character in a CSS template, the server-side rendering can interpret the subsequent content as HTML, potentially exposing users to malicious scripts. This vulnerability is mitigated in version 4.13.16.

Affected Version(s)

hono >= 3.12.0, < 4.13.16

References

https://github.com/honojs/hono/security/advisories/GHSA-3...
x_refsource_CONFIRM
https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189...
x_refsource_MISC
https://github.com/honojs/hono/releases/tag/v4.13.16
x_refsource_MISC

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.