CVE-2026-29085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29085", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T20:51:43.484Z", "datePublished": "2026-03-04T22:09:45.580Z", "dateUpdated": "2026-03-05T15:41:57.607Z"}, "containers": {"cna": {"title": "Hono: SSE Control Field Injection via CR/LF in writeSSE()", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr"}, {"name": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e"}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"version": "< 4.12.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T22:09:45.580Z"}, "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}], "source": {"advisory": "GHSA-p6xx-57qc-3wxr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:39:27.354913Z", "id": "CVE-2026-29085", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:41:57.607Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Hono: SSE Control Field Injection via CR/LF in writeSSE()", "source": {"advisory": "GHSA-p6xx-57qc-3wxr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.4"}]}], "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr", "name": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e", "name": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T22:09:45.580Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:39:27.354913Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-05T15:39:28.393Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-29085", "state": "PUBLISHED", "dateUpdated": "2026-03-04T22:09:45.580Z", "dateReserved": "2026-03-03T20:51:43.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T22:09:45.580Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hono", "vendor": "honojs", "versions": [{"status": "affected", "version": "< 4.12.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "8ADA9966-4575-41CC-8905-E1F4E4CB5CA6", "versionEndExcluding": "4.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.12.4, al usar streamSSE() en Streaming Helper, los campos event, id y retry no se validaban en busca de caracteres de retorno de carro (\\r) o nueva l\u00ednea (\\n). Debido a que el protocolo SSE utiliza saltos de l\u00ednea como delimitadores de campo, esto podr\u00eda permitir la inyecci\u00f3n de campos SSE adicionales dentro del mismo marco de evento si se pasaba entrada no confiable a estos campos. Este problema ha sido parcheado en la versi\u00f3n 4.12.4."}], "id": "CVE-2026-29085", "lastModified": "2026-06-17T10:29:34.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29085", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:39:27.354913Z", "version": "2.0.3"}}]}, "published": "2026-03-04T23:16:10.423", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.12.4)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "hono", "source": "cna", "vendor": "honojs"}, "product": "hono", "vendor": "hono"}], "analysis": {"en": {"generated_at": "2026-04-16T13:04:21.193788+00:00", "value": {"mitigation_remediation": ["Upgrade Hono to version 4.12.4 or later to apply the vendor patch.", "If an upgrade is not yet possible, implement server\u2011side validation to strip or encode any carriage return or newline characters from the event, id, and retry fields before sending them in an SSE response.", "Review application code for any untrusted sources that populate these fields and ensure they are sanitized or use a trusted library that enforces field validation."], "summary": {"action": "Apply Patch", "impact": "SSE Field Injection"}, "threat_synthesis": {"affected_systems": "Hono, the open\u2011source web framework for JavaScript, supported on any Node.js runtime. Versions prior to 4.12.4 are affected; the issue was patched in 4.12.4.", "description_and_impact": "The vulnerability resides in Hono\u2019s Streaming Helper function writeSSE(), which failed to escape carriage return and newline characters in the event, id, and retry fields. Because Server\u2011Sent Events rely on line breaks to separate fields, an attacker could inject malicious or additional fields into the same event frame. This flaw allows arbitrary field injection that could manipulate client\u2011side processing or reveal sensitive data, thereby compromising the confidentiality and integrity of the application data stream.", "risk_and_exploitability": "The CVSS score of 6.5 reflects a moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring an attacker to supply untrusted input to any of the SSE fields in a client\u2011facing endpoint. Exploitation would need the ability to influence these fields, such as through a form submission or API request, allowing the attacker to inject additional SSE directives."}}}}, "created": "2026-03-05T09:05:35.528422+00:00", "updated": "2026-04-16T13:15:06.220584+00:00", "vendors": ["hono", "hono$PRODUCT$hono"]}