Description
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| honojs | hono | < 4.13.7 | 4.13.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.10.hum1 | RHSA-2026:73654 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.6-0.5.hum1 | RHSA-2026:74869, RHSA-2026:73655 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.7.hum1 | RHSA-2026:71906 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hono | < 4.13.7 | 4.13.7 | GHSA-hxh3-vqpv-xpqv |
Advisories 5
- WID-SEC-2026-4131 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:71906 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74869 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:73654 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:73655 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
References
- GitHub Security Advisory (GHSA-hxh3-vqpv-xpqv) vendor-advisory
- VulnCheck Advisory: hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings third-party-advisory