Hono: SSE Control Field Injection via CR/LF in writeSSE()

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-29085 · CVE overview and exploitation status

EUVD-2026-9507

GHSA-p6xx-57qc-3wxr

cve-program · CVE-2026-29085

• https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
• https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e

euvd · EUVD-2026-9507

• https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
• https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e

nvd · CVE-2026-29085

• https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e
• https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr

osv · GHSA-p6xx-57qc-3wxr

• https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr
• https://nvd.nist.gov/vuln/detail/CVE-2026-29085
• https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e
• https://github.com/honojs/hono

• Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newlin… · Advisory content revised · 15 Nov 2026