CVE-2026-84363

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5

Description Query helpers treat a question mark following a literal hash fragment as the start of a query string. This allows the application to read request parameters that are ignored by browsers, reverse proxies, filtering rules, and other middleware. When using the Cache Middleware, the fragment is removed during cache key construction, which can lead to cached responses being influenced by hidden parameters and subsequently served to other users. This behavior can result in the bypass of filtering and auditing, cache poisoning, and stored cross-site scripting if an affected parameter is reflected into cached HTML without proper escaping. Exploitation depends on a runtime and intermediary path that allows a literal hash character to reach the request URL.

Recommendations Update to version 4.13.5.