CVE-2026-93981: Hono Package XSS Vulnerability in JSX Rendering
Summary
CVE-2026-93981: hono/jsx renders plain strings unescaped in boundary components, leading to XSS. Affects hono versions < 4.13.7. Fixed in 4.13.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is a lightweight web framework designed for building web applications and APIs with a focus on performance and simplicity. It utilizes JSX for rendering components, allowing developers to create dynamic user interfaces. However, a recent vulnerability has been identified in the way Hono handles plain strings in certain rendering contexts, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the fact that Hono's JSX does not properly escape plain strings when they are rendered as children in specific components such as Suspense, ErrorBoundary, or Context.Provider. This oversight allows an attacker to inject arbitrary HTML into the server-rendered page if they control the string being rendered. The affected paths treat the input as already-escaped HTML, leading to potential XSS under the application's origin. This issue is particularly concerning for applications that render untrusted strings directly during server-side rendering.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.13.7
This is the first release that contains the fix.
npm install hono@4.13.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid rendering plain strings directly in the affected components. Instead, wrap strings in a safe HTML element or use the raw() or html helper functions provided by Hono to ensure proper escaping.
Conclusion
The CVE-2026-93981 vulnerability in the Hono package poses a significant risk due to improper handling of plain strings in JSX rendering, leading to potential XSS attacks. It is crucial for developers using Hono to update to version 4.13.7 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief while ensuring application security.
See every vulnerability recorded for hono →
FAQ
CVE-2026-93981 is a vulnerability in the Hono package that allows for cross-site scripting (XSS) due to improper handling of plain strings in JSX rendering.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
An attacker could inject malicious HTML into your application, potentially leading to data theft, session hijacking, or other malicious activities.
Yes, the vulnerability has been patched in version 4.13.7 of the Hono package. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 4.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
