hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...

GHSA-HXH3-VQPV-XPQV hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

EUVD-2026-83586

hono/jsx renders plain strings unescaped in boundary components, leading to XSS...

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

Linux Distros Unpatched Vulnerability : CVE-2026-93981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an...

CVE-2026-93981

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981: Improper Neutralization of Input During Web Page Generation

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

PT-2026-95818

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7 Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is presen...

GHSA-F23P-VX2J-J53R Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

CVE-2026-71850: Exposure of Data Element to Wrong Session

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

GHSA-HVRM-45R6-MJFJ hono/jsx does not isolate context per request, leading to cross-request data disclosure

Summary hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext could return a value from a different in-flight request...

CVE-2026-59896

Hono/jsx in the Hono web framework exposes a cross-request data disclosure during server-side rendering. From version 4.11.8 up to, but not including, 4.12.27, context values created via createContext, useContext, jsxRenderer, or useRequestContext were not isolated per request and could be reused...