CVE-2026-56761
hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
- Record
CVE-2026-56761- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-38757
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
- Record
EUVD-2026-38757- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-458j-xx4x-4375
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Summary
Improper handling of JSX attribute names in hono/jsx allows malformed attribute keys to corrupt the generated HTML output.
When untrusted input is used as attribute keys during server-side rendering, specially crafted keys can break out of attribute or tag boundaries and inject unintended HTML.
Details
When rendering JSX elements to HTML strings, attribute values are escaped, but attribute names (keys) were previously inserted into the output without validation.
If an attribute name contains characters such as ", >, or whitespace, it can alter the structure of the generated HTML.
For example, malformed attribute names can:
- Break out of the current attribute and introduce unintended additional attributes
- Break out of the current HTML tag and inject new elements into the output
This issue arises when untrusted input (such as query parameters or form data) is used as JSX attribute keys during server-side rendering.
Impact
An attacker who can control attribute keys used in JSX rendering may inject unintended attributes or HTML elements into the generated output.
This may lead to:
- Injection of unexpected HTML attributes
- Corruption of the HTML structure
- Potential cross-site scripting (XSS) if combined with unsafe usage patterns
This issue affects applications that pass untrusted input as JSX attribute keys during server-side rendering.
- Record
GHSA-458j-xx4x-4375- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
- Record
CVE-2026-56761- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
- Record
CVE-2026-56761- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-458j-xx4x-4375
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Summary
Improper handling of JSX attribute names in hono/jsx allows malformed attribute keys to corrupt the generated HTML output.
When untrusted input is used as attribute keys during server-side rendering, specially crafted keys can break out of attribute or tag boundaries and inject unintended HTML.
Details
When rendering JSX elements to HTML strings, attribute values are escaped, but attribute names (keys) were previously inserted into the output without validation.
If an attribute name contains characters such as ", >, or whitespace, it can alter the structure of the generated HTML.
For example, malformed attribute names can:
- Break out of the current attribute and introduce unintended additional attributes
- Break out of the current HTML tag and inject new elements into the output
This issue arises when untrusted input (such as query parameters or form data) is used as JSX attribute keys during server-side rendering.
Impact
An attacker who can control attribute keys used in JSX rendering may inject unintended attributes or HTML elements into the generated output.
This may lead to:
- Injection of unexpected HTML attributes
- Corruption of the HTML structure
- Potential cross-site scripting (XSS) if combined with unsafe usage patterns
This issue affects applications that pass untrusted input as JSX attribute keys during server-side rendering.
- Record
GHSA-458j-xx4x-4375- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-458j-xx4x-4375
GHSA-458j-xx4x-4375 in @rootio/hono - Patched by Root
Root has patched GHSA-458j-xx4x-4375 in the @rootio/hono package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-458j-xx4x-4375- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1790597695 No score
TuxCare security update for hono (12 CVEs)
TuxCare rebuilt hono to address 12 CVEs. Fixed in 3.12.12-tuxcare.2.
- Record
CLSA-2026-1790597695- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-56761 No score
CVE-2026-56761 in @rootio/hono - Patched by Root
Root has patched CVE-2026-56761 in the @rootio/hono package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-56761- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hononpm |
before 4.12.14 | 4.12.14 |
honoTuxCare:npm From an advisory covering 11 CVEs |
3.12.12-tuxcare.0 up to 3.12.12-tuxcare.2, plus listed versions 3.12.123.12.12-tuxcare.1 |
3.12.12-tuxcare.2 |
@rootio/honoRoot:npm |
before 4.12.12-root.io.2 | 4.12.12-root.io.24.12.14-root.io.34.12.14-root.io.14.12.14-root.io.24.12.14-root.io.44.12.14-root.io.54.12.14-root.io.64.12.14-root.io.74.12.14-root.io.8 |
honoRoot:npm |
before 4.12.12-aikido.2 | 4.12.12-aikido.24.12.14-aikido.34.12.14-aikido.44.12.14-aikido.54.12.14-aikido.64.12.14-aikido.74.12.14-aikido.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56761 is a medium vulnerability (CVSS 5.3) in Hono, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in hono 4.12.14.
References
github.com/honojs/hono/security/advisories/GHSA-458j-xx4x-4375
vulncheck.com/advisories/hono-html-injection-via-improper-jsx-attribute-name-handling-in-ssr
nvd.nist.gov/vuln/detail/CVE-2026-56761