Inconsistent interpretation of HTTP requests in hono - #VU146050
Published: August 28, 2026
Vulnerability identifier: #VU146050
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass filtering or cache unsafe responses.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the query parser and cache middleware when processing request targets containing a literal fragment followed by query parameters. A remote attacker can send a specially crafted request to bypass filtering or cache unsafe responses.
Only deployments where a literal # reaches the application are affected; runtimes or intermediaries that normalize or strip the fragment are not affected.
Affected software
hono
Remediation
Install security update from vendor's website.
hono - update to 4.13.5