Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16,
    Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly
    inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic
    jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the
    intended element context and inject unintended HTML. This vulnerability is fixed in 4.12.16.
    (CVE-2026-44455)

ID	Name	Product	Family	Type	Severity
459664	Echo: hono: security update to 4.12.16	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459664	Echo: hono: security update to 4.12.16	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
441374	SCA: security update for hono (GHSA-69xw-7hcm-h432)	Tenable Cloud Security	SCA Checks	Local	medium
441374	SCA: security update for hono (GHSA-69xw-7hcm-h432)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-44455

medium

Tenable Plugins

medium

medium

medium

medium