hono

### Summary The `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `<style>` element. The check only looks inside each value. When the text before a value ends with `<`, whether that is the template itself or an earlier interpolated value, and the next value starts with `/`, the `/` is not escaped and the combined output contains an unescaped closing tag. ### Details Interpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes `</` therefore canno

CVE: CVE-2026-126359

### Summary `csrf()` validates a request only when its `Content-Type` is one of the three types an HTML form can send. Chromium's hyperlink auditing (`<a ping>`) sends a cross-origin POST with the user's cookies and the content type `text/ping`, which is not in that list. The middleware does not look at `Origin` or `Sec-Fetch-Site` for such a request, so it is passed to the handler. ### Details The middleware skips the origin check when the content type is not one that a form submission produces. The assumption was that any other content type requires a CORS preflight and therefore cannot b

CVE: CVE-2026-126355

### Summary `validator('form')` only recognizes a `multipart/form-data` `Content-Type` that carries nothing but a single `boundary` parameter. A request with another legal parameter, such as `charset`, or with extra whitespace after the `;` is not recognized as a form. The validation callback then receives an empty object, while `c.req.parseBody()` still parses the body as a form. ### Details The check that decides whether a request body is a form was written as a strict pattern over the whole `Content-Type` value. Any parameter list that does not look exactly like `; boundary=...` fails th

CVE: CVE-2026-126356

### Summary `mount()` and `app.mount()` remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on `/app/admin/*`. The outer application routes on the original path, so the middleware does not run. ### Details 1. **Dynamic prefix** (all affected versions): for a mount such as `/api/:tenant/*`, the prefix was removed by the length of the route pattern, not of the matched

CVE: CVE-2026-126357

### Summary RegExpRouter, which the default `SmartRouter` selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it: 1. Middleware whose parameter is written with the explicit default pattern, such as `/api/:tenant{[^/]+}/admin/*`, was not applied to a route written as `/api/:tenant/admin/:id`. (since 4.13.0) 2. Middleware on `/admin/*` was not applied to a route registered on `/admin*` for paths under `/admin/`. (since 4.1.4) 3. For a path with an encoded line terminator (`%0A`, `%0D`, `%E2%80%A8`, `%E2%80%A9`)

CVE: CVE-2026-126358

### Summary `serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. ### Details Hono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved insid

CVE: CVE-2026-109955

### Summary `hono/jsx` does not HTML-escape a plain string placed directly as a child or `fallback` of `Suspense` or `ErrorBoundary`, as the only child of a `Context.Provider`, or as the root value of `renderToString()` / `renderToReadableStream()` from `hono/jsx/dom/server`. Such a string is emitted as markup instead of text. ### Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - `Suspense`: a string child, or a string `fallback` while a child suspends. With streaming, the fallback reaches th

CVE: CVE-2026-93981

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. ## Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so a

### Summary Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. ### Details A fragment is never part of the query, and every standard URL consumer — browsers, `new URL()`, reverse proxies — ignores everything from the first `#` onward. Hono's routing followed that rule; its query helpers did not. For one and the same request, this produces an interpretation differential: - A component in front

CVE: CVE-2026-84363

### Summary When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process. ### Details Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could

CVE: CVE-2026-84364