{"id":"EUVD-2026-30034","enisaUuid":"b50b6949-9d61-374c-8cdb-420b5241f9fd","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.","datePublished":"May 13, 2026, 2:57:05 PM","dateUpdated":"May 14, 2026, 1:46:11 PM","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432\n","aliases":"CVE-2026-44455\nGHSA-69xw-7hcm-h432\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"668ff354-cedf-38ee-a0a3-cc40e6b2ac54","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.16"}],"enisaIdVendor":[{"id":"c6dc67ad-9b35-31d3-8b50-1bfcee6326c3","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"017a7300-a5ea-3873-8d75-df748a243134","vulnerability":{"id":"CVE-2026-44455","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.","datePublished":"May 13, 2026, 2:57:05 PM","dateUpdated":"May 14, 2026, 1:46:11 PM","status":"PUBLISHED","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432\n","enisa_id":"EUVD-2026-30034\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"251fc3b4-7efc-33b7-b6c0-fcf6280ff481","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.16"}],"vulnerabilityVendor":[{"id":"1875697e-a48c-30bb-a2fd-343ef427fb5e","vendor":{"name":"honojs"}}]}},{"id":"5071d07a-d865-3a0a-b1d1-cc40c709224c","vulnerability":{"id":"GHSA-69xw-7hcm-h432","description":"hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection","datePublished":"May 6, 2026, 11:49:43 PM","dateUpdated":"May 14, 2026, 8:31:59 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44455\nhttps://github.com/honojs/hono\n","enisa_id":"EUVD-2026-30034\n","aliases":"CVE-2026-44455\nGHSA-69xw-7hcm-h432\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}