# CVE-2026-126359: Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Source: https://junglewise.ai/threats/cve-2026-126359-hono-css-helper-does-not-escape-a-closing-tag-split-between-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126359 · Severity: low · CVSS 3.4 · Published 2026-11-13

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.

Technologies: [hono (npm)](https://junglewise.ai/threats/technologies/hono). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126359 being exploited in the wild.

**How severe is CVE-2026-126359?** Low severity, with a CVSS score of 3.4, published 13 November 2026.

**Which products and versions are affected?** hono (npm) >= 3.12.0, <= 4.13.15, SEMVER:introduced=3.12.0,fixed=4.13.16.

**Is there a fix for CVE-2026-126359?** Yes. hono (npm): upgrade to 4.13.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-126359?** Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hono (npm): upgrade to 4.13.16 or later

  ```sh
  npm install hono@4.13.16
  ```


## Affected products

- hono (npm) >= 3.12.0, <= 4.13.15, SEMVER:introduced=3.12.0,fixed=4.13.16

## Identifiers

- CVE-2026-126359
- GHSA-3gg2-335m-rxc6

## Related threats

- [Hono RegExpRouter middleware bypass via wildcard matching](https://junglewise.ai/threats/cve-2026-126358-hono-regexprouter-skips-wildcard-middleware-for-some-route-sets)
- [Hono mount() path traversal bypasses middleware scoping](https://junglewise.ai/threats/cve-2026-126357-hono-mount-and-app-mount-can-forward-a-path-that-bypasses)
- [Hono validator form multipart/form-data parameter bypass](https://junglewise.ai/threats/cve-2026-126356-hono-validator-form-skips-validation-for-multipart-form-data)
- [Hono csrf() middleware bypass via hyperlink auditing](https://junglewise.ai/threats/cve-2026-126355-hono-csrf-does-not-check-requests-sent-by-hyperlink-auditing)
- [Hono serveStatic authorization bypass via double percent-decoding](https://junglewise.ai/threats/cve-2026-111757-hono-is-a-web-application-framework-that-provides-support-for)