CVE-2026-84363: Hono Web Framework XSS Vulnerability

CVE-2026-84363 Overview

CVE-2026-84363 affects Hono, a Web application framework supporting any JavaScript runtime. Versions prior to 4.13.5 mishandle URL fragments in query helpers. The framework treats a question mark following a literal hash character as the start of a query string. This creates a parser discrepancy [CWE-444] between Hono and standard components such as browsers, new URL(), reverse proxies, and filtering middleware. The Cache Middleware compounds the flaw by stripping the fragment when constructing cache keys. Attackers can poison shared cache entries, bypass allow and deny lists, and inject stored cross-site scripting when reflected parameters land in cached HTML.

Critical Impact
Cache poisoning and stored XSS become possible when a runtime or intermediary passes a literal # character through to the request URL, letting attacker-controlled parameters influence responses served to other users.

Affected Products

Hono framework versions prior to 4.13.5
Applications using Hono's query helpers behind intermediaries that preserve URL fragments
Hono deployments using the Cache Middleware for shared response caching

Discovery Timeline

2026-09-01 - CVE-2026-84363 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84363

Vulnerability Analysis

Hono exposes query helpers that parse the raw request URL rather than delegating to the WHATWG URL parser. The helper scans for the first ? character in the URL string and treats everything after it as the query component, ignoring the standard rule that a # fragment terminates the path and query. When a request URL such as /path#section?admin=1 reaches the application, Hono's helper returns admin=1 as a query parameter. Browsers, new URL(), and most reverse proxies never send or observe that parameter.

This inconsistent request interpretation lets attackers smuggle parameters past validation, allow lists, deny lists, access logging, and other middleware. The Cache Middleware then removes the fragment when computing its cache key, so a response influenced by fragment-embedded parameters is stored under a key that omits those parameters and served to subsequent users.

Root Cause

The getQueryStrings function in src/utils/url.ts located ? without checking for a preceding #. The Cache Middleware in src/middleware/cache/index.ts applied key.split('#', 1)[0] when building the cache key, discarding the fragment. The combination produces a classic HTTP parser mismatch [CWE-444].

Attack Vector

Exploitation requires a runtime and intermediary path that forwards a literal # character to the origin request URL. Cloudflare Workers and any intermediary that normalizes or strips fragments are not affected. An attacker crafts a URL containing a hash followed by a query string, then either lures a victim to visit it or requests it directly to poison a cached response reflected to others.

typescript

// Patch in src/utils/url.ts
export const getQueryStrings = (url: string): string => {
  const queryIndex = url.indexOf('?', 8)
  if (queryIndex === -1) {
    return ''
  }

  const hashIndex = url.indexOf('#', 8)
  return hashIndex === -1
    ? url.slice(queryIndex)
    : queryIndex < hashIndex
      ? url.slice(queryIndex, hashIndex)
      : ''
}

// Patch in src/middleware/cache/index.ts
// - url.searchParams.append(cacheKeyParameter, key.split('#', 1)[0])
// + url.searchParams.append(cacheKeyParameter, key)

Source: GitHub Commit 9c28d724

Detection Methods for CVE-2026-84363

Indicators of Compromise

Inbound request URLs containing a literal %23 or unencoded # followed by ? and parameter names.
Cached HTML responses that reflect parameters not present in the observed request query string.
Middleware access logs missing parameters that the application backend acted upon.

Detection Strategies

Compare parameters parsed by Hono's c.req.query() against parameters yielded by new URL(c.req.url).searchParams at request entry and alert on mismatches.
Instrument the Cache Middleware to log the raw request URL alongside the computed cache key and flag entries where the URL contains #.
Perform code inventory scans for Hono versions below 4.13.5 in package.json and lockfiles.

Monitoring Recommendations

Forward Hono application logs and reverse proxy access logs into a unified telemetry pipeline for cross-parser comparison.
Track cache hit ratios and response body diffs for the same cache key to identify poisoning events.
Monitor outbound response bodies for unexpected reflected parameter values that could indicate stored XSS injection.

How to Mitigate CVE-2026-84363

Immediate Actions Required

Upgrade Hono to version 4.13.5 or later across all services and deployment targets.
Audit any custom middleware that consumes c.req.query() for reliance on the pre-patch parsing behavior.
Invalidate and purge existing shared cache entries produced by the Cache Middleware before restoring traffic.

Patch Information

The fix ships in Hono 4.13.5. The commit 9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc updates getQueryStrings to terminate the query slice at the fragment boundary and removes the key.split('#', 1)[0] truncation from the Cache Middleware key builder. See the GitHub Security Advisory GHSA-crvj-82cr-hjcx and the Hono v4.13.5 release notes for full details.

Workarounds

Deploy behind an intermediary that strips URL fragments before forwarding, such as Cloudflare Workers or a reverse proxy configured to normalize the request line.
Replace calls to Hono query helpers with new URL(c.req.url).searchParams for security-critical parameter parsing until the upgrade lands.
Disable the Cache Middleware or route around it for handlers that reflect user-controlled parameters into HTML responses.

bash

# Upgrade Hono to the patched release
npm install hono@^4.13.5

# Verify the installed version
npm ls hono