EUVD-2026-9507

🗓️ 04 Mar 2026 19:48:41Reported by EUVDType

Hono vulnerability allows SSE control field injection via carriage return line feed in writeSSE.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to node modules Hono and Undici	30 Mar 202612:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	8 Jun 202607:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to path traversal (CVE-2026-29045) loss of integrity (CVE-2026-29085) and loss of confidentiality (CVE-2026-29086)	31 Mar 202615:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 May 202605:43	–	ibm
ATTACKERKB	CVE-2026-29085	4 Mar 202622:09	–	attackerkb
Chainguard	CVE-2026-29085 vulnerabilities	19 Mar 202601:17	–	cgr
Circl	CVE-2026-29085	5 Mar 202600:33	–	circl
CNNVD	Hono 注入漏洞	4 Mar 202600:00	–	cnnvd
CVE	CVE-2026-29085	4 Mar 202622:09	–	cve
Cvelist	CVE-2026-29085 Hono: SSE Control Field Injection via CR/LF in writeSSE()	4 Mar 202622:09	–	cvelist

[
  {
    "enisaIdVendor": [
      {
        "id": "c03a07af-3113-32b3-ab37-65cf51146699",
        "vendor": {
          "name": "honojs"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "139b0e48-a301-3753-8d97-a3d640b3822f",
        "product": {
          "name": "hono"
        },
        "product_version": "< 4.12.4"
      }
    ]
  }
]

Source	Link
github	www.github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
github	www.github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e

04 Mar 2026 19:48Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.0024