CVE-2026-126359

CVSS 3.4 (low) · published 2026-11-13

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.

Weakness: CWE-79

Source: NVD CVE-2026-126359

References

• https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513
• https://github.com/honojs/hono/releases/tag/v4.13.16
• https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.