Medium severity · published Mar 4, 2026
CVE-2026-29085
Hono: SSE Control Field Injection via CR/LF in writeSSE()
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newline (\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hono · honojs
< 4.12.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29085
Patch
https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e
Vendor Advisory
https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
More from hono
9.8
CVE-2026-29045
Hono: Arbitrary file access via serveStatic vulnerability
8.1
CVE-2025-62610
Hono Improperly Authorizes JWT Audience Validation
7.5
CVE-2026-39408
Hono has a path traversal in toSSG() allows writing files outside the output directory
7.5
CVE-2026-27700
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
7.5
CVE-2025-58362
Hono contains a flaw in URL path parsing, potentially leading to path confusion