Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newline (\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
Patch x_refsource_misc
https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e
Scores
CVSS v3
6.5
EPSS
0.0006
EPSS Percentile
17.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
Status
published
Products (2)
hono/hono
< 4.12.4
npm/hono
0 - 4.12.4npm
Published
Mar 04, 2026
Tracked Since
Mar 05, 2026