CVE-2026-126359

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.

• CWE-79

• https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513
• https://github.com/honojs/hono/releases/tag/v4.13.16
• https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126353Addressable is an alternative implementation to the URI impl…5.9
• CVE-2026-126354Addressable is an alternative implementation to the URI impl…4.8
• CVE-2026-126355Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126356Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126357Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126358Hono is a Web application framework that provides support fo…5.3
• CVE-2026-126360OpenTelemetry Python provides the Python API and SDK for Ope…5.3
• CVE-2026-126361Astro is a web framework for content-driven websites. Prior …2.3
• CVE-2026-126362Astro is a web framework for content-driven websites. From 5…2.3
• CVE-2026-126363Astro is a web framework for content-driven websites. From 0…2.3
• CVE-2026-126364Astro is a web framework for content-driven websites. From 5…6.3
• CVE-2026-126365Astro is a web framework for content-driven websites. Prior …5.4