SB2026072450 - Multiple vulnerabilities in hono
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Use of Less Trusted Source (CVE-ID: CVE-2026-59897)
CWE-ID: CWE-348 - Use of Less Trusted Source
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to alter security or routing decisions.
The vulnerability exists due to use of less trusted source in the AWS API Gateway v1 adapter header de-duplication logic when processing repeated request headers. A remote attacker can send repeated header values where one value is a substring of another to alter security or routing decisions.
The issue occurs because distinct repeated header values may be omitted before the application processes the request, which can affect logic that relies on the complete ordered header value list.
2) Cross-site scripting (CVE-ID: CVE-2026-59895)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in the cx() utility in hono/css when rendering JSX class attributes during server-side rendering with untrusted input. A remote attacker can supply a crafted class name value to inject arbitrary markup and execute arbitrary script in the victim's browser.
Applications are affected only if they render JSX server-side and pass untrusted input as a class name to cx(). User interaction is required for a victim to load the rendered page.
3) Race condition (CVE-ID: CVE-2026-59896)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a race condition in hono/jsx server-side rendering context handling when rendering concurrent requests with async components that read context after an await. A remote attacker can trigger concurrent request processing to disclose sensitive information.
The issue affects createContext()/useContext() and the jsxRenderer middleware with useRequestContext(). Only context reads that occur after an await during concurrent server-side rendering are affected; synchronous reads and client-side rendering are not affected.
Remediation
Install update from vendor's website.