CVE-2026-56761 hono - HTML Injection via Improper JSX Attribute Name Handling in SSR
Attackers can inject arbitrary HTML or scripts via malformed JSX attribute names in Hono's server-side rendering, potentially leading to XSS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-56761?
CVE-2026-56761 is a medium-severity cross-site scripting vulnerability in hono, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.
Weakness: CWE-79
Which versions are affected by CVE-2026-56761?
2 open source packages ship an affected version, including hono. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.12.14 |
hono npm | All versions | 4.12.14 |
Products include Hono Hono.
How do I fix CVE-2026-56761?
Upgrade hono to 4.12.14 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-56761 being exploited?
There is no known exploitation of CVE-2026-56761 in the wild and no public exploit code.
Other vulnerabilities in hono
- CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
- CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
- CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation
- CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability
Sources
Also known as CLEANSTART-2026-YG16880, ECHO-985a-be76-78fe, GHSA-458j-xx4x-4375, MINI-223w-382m-6v5v, MINI-22hj-9r93-47v2, MINI-6gw4-h5vm-9h7r and 5 more.