p PatchFirst

CVE-2026-93981

CVE-2026-93981 · hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

This page contains facts from public vulnerability sources. Check the original advisory before updating.

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

CVSS 2.3 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • hono

    Versions
    • ≥ 0, < 4.13.7: Affected (semver)
    • 4.13.7: Not affected (semver)

    Update to 4.13.7

  • hono npm

    Affected ranges
    • SEMVER: < 4.13.7

    Update to 4.13.7

Original sources

Check your server →