Is CVE-2026-56761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56761 being exploited in the wild.

How severe is CVE-2026-56761?

Medium severity, with a CVSS score of 4.3, published 24 June 2026.

Which products and versions are affected?

hono (npm) < 4.12.14, SEMVER:introduced=0,fixed=4.12.14.

Is there a fix for CVE-2026-56761?

Yes. hono (npm): upgrade to 4.12.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56761 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56761?

Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56761: Hono HTML injection in JSX server-side rendering

Q: Which products and versions are affected?

hono (npm) < 4.12.14, SEMVER:introduced=0,fixed=4.12.14.

Q: Is there a fix for CVE-2026-56761?

Yes. hono (npm): upgrade to 4.12.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56761 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56761?

Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56761 · Severity: medium · CVSS 4.3 · Published 2026-06-24

hono is a popular web framework for building server-side rendered applications with JSX. The framework fails to validate JSX attribute names during HTML generation, allowing attackers to inject malicious HTML attributes or elements if they can control attribute keys. This vulnerability could enable attackers to alter page content, inject scripts, or trick users through crafted HTML output.

Technologies: hono (npm). Vendors: npm.

Quick answers

Is CVE-2026-56761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56761 being exploited in the wild.
How severe is CVE-2026-56761?: Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?: hono (npm) < 4.12.14, SEMVER:introduced=0,fixed=4.12.14.
Is there a fix for CVE-2026-56761?: Yes. hono (npm): upgrade to 4.12.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56761 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56761?: Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hono (npm): upgrade to 4.12.14 or later
```
npm install hono@4.12.14
```

Technical details

The vulnerability exists in hono's JSX SSR implementation where attribute values are escaped but attribute names (keys) are inserted into HTML output without validation. When untrusted input is used as JSX attribute keys, malformed keys containing special characters like double quotes ("), angle brackets (>), or whitespace can break out of attribute boundaries or tag boundaries to inject unintended HTML. An attacker controlling attribute keys during server-side rendering can inject unexpected attributes, corrupt HTML structure, or potentially enable XSS attacks when combined with unsafe usage patterns. The vulnerability affects all versions prior to 4.12.14, where the fix validates and sanitizes attribute names before insertion into the HTML output. Attack vector is network-based, requires user interaction, and does not require elevated privileges.

Affected products

honojs hono before 4.12.14

Identifiers

CVE-2026-56761
GHSA-458j-xx4x-4375

Timeline

2026-04-16: disclosed: GHSA-458j-xx4x-4375 published
2026-04-16: patched: Fixed in hono 4.12.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.