Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-01T21:18:47.173Z",
  "pubdate": "2026-09-01T21:18:47.173Z",
  "executiveSummary": "Hono versions prior to 4.13.5 are susceptible to a query injection vulnerability stemming from improper URL fragment handling. The framework's query helpers incorrectly interpret a question mark following a literal hash fragment (#) as the initiation of a query string. This discrepancy creates a divergence between how Hono parses request parameters and how other components—such as browsers, reverse proxies, and middleware—process the URL.\nThis vulnerability allows an attacker to inject parameters that remain hidden from security filters, logging mechanisms, and validation middleware. When combined with the Cache Middleware, which strips fragments during cache key generation, the vulnerability enables response poisoning. A malicious response, influenced by parameters hidden within the fragment, can be cached and subsequently served to legitimate users. The impact includes the potential for stored cross-site scripting (XSS), the bypass of access control policies, and the subversion of audit logs. Exploitation is contingent upon an environment (specifically runtime and intermediary infrastructure) that permits the transmission of a literal hash character in the request URL, excluding environments like Cloudflare Workers that normalize or strip fragments.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic used by Hono’s query helpers to parse the request URL. By treating the string following a '#' symbol as a legitimate start to a query string if a '?' is present, the framework creates a parsing inconsistency. In standard web architecture, the fragment identifier (#) is intended for client-side use and is typically not sent to the server. However, if the underlying runtime or an intermediary proxy forwards the full URL including the fragment, Hono’s internal logic processes these segments as active query parameters.\nThe attack flow begins when an attacker crafts a request URL containing a fragment such as '/path#?param=value'. While standard browser behavior or security middleware interprets this as a single resource location without 'param=value', Hono’s query helpers erroneously parse the injected parameter. This results in the application executing logic based on attacker-supplied input that remains completely invisible to the security stack, including parameter allow/deny lists and request validation routines.\nA critical escalation path exists via the Hono Cache Middleware. Because the middleware generates cache keys by stripping the fragment, it treats the manipulated request as identical to a legitimate request to '/path'. If the application reflects the injected parameter in the response body—for instance, in a search result or dynamic HTML template—the Cache Middleware will store the resulting output under the non-parameterized cache key. Consequently, subsequent users requesting '/path' will receive the attacker’s poisoned response. This provides a vector for stored XSS if the reflected content is not properly sanitized or encoded, and it effectively bypasses caching security controls.\nExploitation requires the request to pass through infrastructure that preserves the literal '#' character. Environments that normalize URLs or strip fragments before they reach the Hono runtime are inherently protected. The vulnerability affects Hono versions prior to 4.13.5. There are no specific authentication or privilege requirements for this attack, as the injection occurs at the request parsing layer, and the impact is dependent on the application's subsequent handling of reflected parameters."
}