CVE-2026-29085: Hono Package Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
Summary
CVE-2026-29085: Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE(). Affects hono versions < 4.12.4. Fixed in 4.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is a lightweight web framework designed for building HTTP APIs and web applications. It provides features for handling requests and responses efficiently, making it popular among developers for its simplicity and performance. However, a recent vulnerability has been identified that affects its Streaming Helper functionality, specifically in the handling of Server-Sent Events (SSE). This vulnerability arises from inadequate validation of input fields, potentially allowing attackers to manipulate the event stream.
Vulnerability Detail
The vulnerability occurs when using the streamSSE() function in the Streaming Helper. The 'event', 'id', and 'retry' fields do not validate for carriage return (\r) or newline (\n) characters. Since the SSE protocol uses line breaks as field delimiters, this oversight can lead to the injection of additional SSE fields within the same event frame if untrusted input is provided. An attacker could exploit this to alter the structure of SSE event frames, potentially leading to client-side script injection if the application renders data in an unsafe manner.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.4
This is the first release that contains the fix.
npm install hono@4.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user-controlled input passed to the 'event', 'id', and 'retry' fields is sanitized to remove any CR/LF characters. This can be done using a simple function like the following: function sanitizeInput(input) { return
input.replace(/\r|\n/g, '');
}
Conclusion
The Hono package has a vulnerability (CVE-2026-29085) that allows for SSE control field injection due to improper validation of input fields. It is crucial to update to version 4.12.4 or later to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary workaround until the package is updated.
See every vulnerability recorded for hono →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to inject additional fields into the SSE event stream, potentially leading to client-side script injection.
Yes, the vulnerability has been patched in version 4.12.4 of the Hono package. It is recommended to update to this version or later.
If an immediate update is not possible, implement input sanitization to remove CR/LF characters from user-controlled inputs for the affected fields.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
