CVE-2026-84363

Received Received - Intake

Hono Framework Query Helper Fragment Handling Flaw

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84363

Affected Vendors & Products

Vendor	Product	Version / Range
hono	hono	4.13.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

Hono is a web application framework for JavaScript runtimes. A vulnerability exists in versions prior to 4.13.5 where query helpers incorrectly handle a question mark after a hash fragment in URLs. This allows request parameters within the fragment to be processed as query parameters, bypassing normal security checks and middleware. The Cache Middleware further exacerbates this by removing the fragment when creating cache keys, enabling responses influenced by hidden parameters to be cached and served to other users.

Detection Guidance

This vulnerability requires checking if your Hono framework version is below 4.13.5. Run 'npm list hono' or check your package.json to verify the installed version. If the version is older, the system is vulnerable.

Impact Analysis

This vulnerability can lead to cache poisoning, where malicious responses are stored and served to other users. It may also enable stored cross-site scripting if untrusted parameters are reflected in cached HTML without proper escaping. Attackers could bypass filtering, auditing, or parameter restrictions, potentially accessing sensitive data or executing unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if cached responses leak sensitive data or enable unauthorized access, potentially resulting in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Upgrade Hono to version 4.13.5 or later immediately. Use 'npm update hono' or adjust your package.json to specify the latest version. Ensure no intermediaries pass literal hash characters through to request URLs.

Hi! I’m here to help you understand CVE-2026-84363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70