CVE-2026-44455

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.

• CWE-74

• https://github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432Vendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4445Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44450Lumiverse is a full-featured AI chat application. Prior to 0…9.9
• CVE-2026-44451Lumiverse is a full-featured AI chat application. Prior to 0…9.3
• CVE-2026-44452h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …5.9
• CVE-2026-44453h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-44454Coder allows organizations to provision remote development e…8.8
• CVE-2026-44456Hono is a Web application framework that provides support fo…6.5
• CVE-2026-44457Hono is a Web application framework that provides support fo…5.3
• CVE-2026-44458Hono is a Web application framework that provides support fo…4.3
• CVE-2026-44459Hono is a Web application framework that provides support fo…3.8
• CVE-2026-4446Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44460FileRise is a self-hosted web-based file manager with multi-…7.4