p PatchFirst

CVE-2026-44455

CVE-2026-44455 · Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.

CVSS 4.7 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • hono

    Versions
    • < 4.12.16: Affected

    No fix published

  • hono npm

    Affected ranges
    • SEMVER: < 4.12.16

    Update to 4.12.16

Original sources

Check your server →