CVE-2026-29085
SSE Injection Vulnerability in Hono Streaming Helper Before
Publication date: 2026-03-04
Last updated on: 2026-03-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hono | hono | to 4.12.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Hono web application framework prior to version 4.12.4. When using the streamSSE() function in the Streaming Helper, the event, id, and retry fields were not properly validated for carriage return (\r) or newline (\n) characters. Since the Server-Sent Events (SSE) protocol uses line breaks as delimiters between fields, an attacker could inject additional SSE fields within the same event frame by including these characters in untrusted input passed to these fields.
This improper validation could lead to injection attacks within the SSE stream.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to inject additional SSE fields into the event stream. This could lead to manipulation of the data sent to clients, potentially causing incorrect or malicious event data to be processed.
According to the CVSS score of 6.5 (medium severity), the impact includes limited confidentiality and integrity loss, but no impact on availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Hono Web application framework to version 4.12.4 or later, where the issue has been patched.