Executive brief
Hono is a web framework that includes a Streaming Helper for Server-Sent Events (SSE), a technology for pushing real-time updates to web clients. The SSE helper failed to properly validate user input in event metadata fields, allowing attackers to inject malicious control characters that could alter the event stream structure or potentially inject client-side script code if applications rendered the data unsafely.
Technical details
This is an injection vulnerability (CWE-74) in Hono's streamSSE() function within the Streaming Helper. The event, id, and retry fields were not validated for carriage return (\r) and newline (\n) characters, which are protocol delimiters in SSE. An attacker could craft input containing CR/LF sequences to inject additional SSE fields or alter event stream parsing. The attack requires no authentication or user interaction and is network-reachable. Depending on application behavior, this could result in injected SSE fields, altered event handling, or client-side script injection if e.data is rendered unsafely (e.g., via innerHTML). The fix validates and rejects CR/LF characters in these control fields. Versions prior to 4.12.4 are affected.
Affected products
- Honojs Hono < 4.12.4
Timeline
- 2026-03-04: disclosed
- 2026-03-04: patched: Version 4.12.4 released with fix