CVE-2026-29085

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newline (\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-04 | Updated 2026-03-05 | Assigner GitHub_M

Problem types

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Product status

References

github.com/...s/hono/security/advisories/GHSA-p6xx-57qc-3wxr

github.com/...ommit/f4123ed9ea3c7c52380cc99a079a4d773838846e

cve.org (CVE-2026-29085)

nvd.nist.gov (CVE-2026-29085)

Download JSON