SB2026072453 - Multiple vulnerabilities in hono

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-44456)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass request size restrictions and reach handler logic with oversized requests.

The vulnerability exists due to improper input validation in the bodyLimit() middleware when handling chunked or unknown-length requests. A remote attacker can send an oversized chunked request to bypass request size restrictions and reach handler logic with oversized requests.

This can occur when the handler does not read the body, reads only the first chunks and returns, or catches and suppresses body read errors.

2) Input validation error (CVE-ID: CVE-2026-44455)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject unintended HTML into the generated output.

The vulnerability exists due to improper input validation in hono/jsx server-side rendering via the jsx() or createElement() APIs when rendering untrusted input as JSX tag names. A remote attacker can supply a specially crafted tag name to inject unintended HTML into the generated output.

User interaction is required, and cross-site scripting may occur when combined with unsafe usage patterns.

Remediation

Install update from vendor's website.

References

• https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v
• https://github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432