Web Application Framework Vulnerability in Hono by HonoJS

CVE-2026-84363

What is CVE-2026-84363?

The Hono web application framework contains a vulnerability where its query helpers mistakenly interpret a question mark following a literal hash fragment as the start of a query string. This flaw allows applications to read request parameters that various intermediaries, including browsers and filters, might overlook. The Cache Middleware, specifically, excludes the fragment when generating cache keys, which can result in the storage of responses influenced by fragment parameters. This can lead to cached responses being poisoned, facilitating stored cross-site scripting (XSS) exploits if affected parameters are reflected into cached HTML without proper escaping. Exploitation necessitates a specific runtime environment where the literal hash character is passed through to the request URL, leaving certain intermediaries like Cloudflare Workers unscathed. This issue has been addressed in Hono version 4.13.5.

References