CVE-2026-93981

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7

Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is present, as the single child of a Context.Provider, or as the root value passed to the renderToString() or renderToReadableStream() functions from hono/jsx/dom/server. In these cases, the input is stringified and treated as already-escaped markup, allowing an attacker to inject arbitrary HTML and execute scripts under the application's origin during server-side rendering.

Recommendations Update hono to version 4.13.7 or later.