EUVD-2026-69610
GHSA-crvj-82cr-hjcx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
AC:H for runtime prerequisite; stored XSS crosses scope (S:C, UI:R); C:L for session exfiltration potential; I:H for full cache-response substitution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 98 npm packages depend on hono (47 direct, 52 indirect)
Ecosystem-wide dependent count for version 4.13.5.
DescriptionCVE.org
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.
AnalysisAI
Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal #? sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be true simultaneously: (1) the Hono application runs on a runtime and behind intermediaries that forward the literal `#` character in request URLs to the application - Cloudflare Workers is explicitly confirmed safe; common Node.js/Bun/Deno deployments behind some reverse proxy configurations are potentially exposed; (2) Hono's Cache Middleware (`cache()`) is configured on the affected route - applications not using the Cache Middleware are not vulnerable to cache poisoning, though the parameter-smuggling discrepancy still exists for bypassing WAF/logging; and (3) for stored XSS impact specifically, the application reflects a `c.req.query()` value into cached HTML output without proper output escaping. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) captures the cache-poisoning primitive accurately but understates the worst-case impact path: when the application reflects fragment-readable parameters into cached HTML without escaping, the result is stored XSS, which crosses a scope boundary into the victim's browser and enables confidentiality impact via session or credential theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Hono 4.13.5, available at https://github.com/honojs/hono/releases/tag/v4.13.5, which patches both the URL parsing helpers and the Cache Middleware cache-key logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The adapter @hono/node-server allows you to run your Hono application on Node.js. Rated high severity (CVSS 7.5), this v
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthen
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3),
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Rated medium severity (CVSS 5.3),
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0),
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped c
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploita
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream client
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today