Hono EUVD-2026-83586

Exploitation requires the target application to use hono/jsx server-side rendering in one of four specific ways: a plain string as a child or fallback of Suspense, a string child of ErrorBoundary alongside an asynchronous sibling, the single child of a Context.Provider, or the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. In addition, attacker-controlled data must flow directly into that string during SSR, and a victim must load the rendered output (UI:P). These narrow, app-specific coding patterns are the primary limiting factor - a Hono app that does not use these exact patterns with untrusted input is not exploitable. No authentication is required of the attacker (PR:N). Fixed in hono 4.13.7.

This is a genuinely low-priority XSS despite the network attack vector. The vendor CVSS 4.0 base score is 2.3 (Low), and the vector reflects why: AC:H and AT:P (attack requirement present) capture that exploitation is not a general property of the framework but is confined to four narrow hono/jsx server-side-rendering code paths - a plain string used as a Suspense child/fallback, an ErrorBoundary string child alongside an async sibling, the single child of a Context.Provider, or the root value passed to renderToString()/renderToReadableStream() from hono/jsx/dom/server. The application must both use one of those specific patterns AND route attacker-controlled data directly into it. UI:P/UI:R further requires a victim to render/view the malicious output. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Impact is limited (VC:L/VI:L, i.e. client-side script execution under the app origin), not a server compromise. Bottom line: a real defense-in-depth bug worth patching by upgrading to hono 4.13.7, but not an urgent, widely-exploitable issue - the signals are internally consistent (low CVSS, no exploitation intelligence, narrow preconditions) with no conflicts to flag.

A developer builds a Hono app that server-side renders a JSX component where user-supplied data (e.g. a username or query parameter) is passed as the direct string child of a Suspense fallback or as the root value to renderToString(). An attacker submits a value like '<script>...</script>'; because these paths treat the stringified input as already-escaped markup, the script is emitted verbatim and executes in the victim's browser under the application's origin. No public exploit code was identified at time of analysis.