Injection Vulnerability in Hono Framework Affects JavaScript Runtimes
CVE-2026-29085

6.5MEDIUM

Key Information:

Vendor

Honojs

Status
Hono
Vendor
CVE Published:
4 March 2026

What is CVE-2026-29085?

The Hono Framework, a versatile web application framework for JavaScript runtimes, contains a vulnerability in its streamSSE() functionality within the Streaming Helper. The event, id, and retry fields were susceptible to injection of additional Server-Sent Events (SSE) fields due to the lack of validation for carriage return ( ) and newline ( ) characters. This could potentially allow attackers to manipulate SSE packets through untrusted input, leading to unintended behavior or information leakage. The issue has been resolved in version 4.12.4, making it imperative for users to update to this version to ensure protection.

Affected Version(s)

hono < 4.12.4

References

https://github.com/honojs/hono/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.