CVE-2026-126359: Cross-Site Scripting via Split Closing Style Tag in Hono CSS Helper

Vulnerability ID: CVE-2026-126359
CVSS Score: 3.4
Published: 2026-11-12

CVE-2026-126359 (GHSA-3gg2-335m-rxc6) is an improper input neutralization vulnerability (CWE-79) in the Hono web framework (honojs/hono). Versions from 3.12.0 prior to 4.13.16 evaluate and escape interpolated strings in the hono/css helper individually before concatenating template chunks and stripping CSS comments. When a < character and a /style> sequence are split across template boundaries, adjacent interpolations, or separated by a CSS comment, the sanitizer fails to escape the closing tag sequence. During Server-Side Rendering (SSR), the <Style /> component outputs an unescaped </style> delimiter, permitting an attacker to break out of the CSS raw text context and execute arbitrary HTML and JavaScript in the victim's browser.

TL;DR

Hono versions 3.12.0 through 4.13.15 fail to escape closing </style> tags in the hono/css helper when the < and / characters are split across template literals, adjacent interpolations, or CSS comments. This enables Cross-Site Scripting (XSS) during Server-Side Rendering (SSR). Upgrade to Hono 4.13.16 to resolve the issue.

⚠️ Exploit Status: POC

Technical Details

  • CVE / GHSA ID: CVE-2026-126359 / GHSA-3gg2-335m-rxc6
  • Vulnerability Class: CWE-79: Cross-Site Scripting (XSS) / HTML Injection
  • Affected Component: hono/css helper (buildStyleString in src/helper/css/common.ts)
  • CVSS v3.1 Score: 3.4 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
  • EPSS Score: 0.26% (Percentile: 18.11%)
  • Affected Versions: hono >= 3.12.0, < 4.13.16
  • Patched Version: hono 4.13.16
  • CISA KEV Status: Not Listed

Affected Systems

  • Hono web framework (hono npm package and @hono/hono JSR package) versions >= 3.12.0, < 4.13.16 across Node.js, Deno, Bun, Cloudflare Workers, Fastly Compute, and AWS Lambda
  • hono: >= 3.12.0, < 4.13.16 (Fixed in: 4.13.16)

Code Analysis

Commit: 15bbd96

Escape closing tags in buildStyleString after minification to prevent split-tag HTML injection in hono/css

diff --git a/src/helper/css/common.ts b/src/helper/css/common.ts index f32ccb27e0..fee9be8100 100644 --- a/src/helper/css/common.ts +++ b/src/helper/css/common.ts @@ -165,11 +165,7 @@ export const buildStyleString = ( continue } if (typeof value === 'string') { - if (/([\\"'\/])/.test(value)) { - styleString += value.replace(/([\\"']|(?<=<)\/)/g, '\\$1') - } else { - styleString += value - } + styleString += value.replace(/[\\"']/g, '\\$&') } else if (typeof value === 'number') { styleString += value } else if ((value as CssEscapedString)[CSS_ESCAPED]) { @@ -199,7 +195,8 @@ export const buildStyleString = ( } } - return [label, minify(styleString), selectors, externalClassNames] + // Minification can join `<` and `/` across template parts or removed comments. + return [label, minify(styleString).replace(/<\//g, '<\\/'), selectors, externalClassNames] }

Mitigation Strategies

  • Upgrade Hono to version 4.13.16 or later to ensure post-minification escaping of closing HTML tags inside CSS blocks.
  • Avoid interpolating untrusted user input directly into css tagged template literals; prefer passing dynamic values via inline JSX style custom properties (CSS variables).
  • Implement strict Content Security Policy (CSP) headers (e.g., disallowing unsafe-inline scripts) to restrict the execution of injected <script> tags and inline event handlers.

Remediation Steps:

  1. Identify all projects utilizing hono between versions 3.12.0 and 4.13.15 via npm ls hono or lockfile inspection.
  2. Upgrade hono to version 4.13.16 or newer using npm install hono@latest, bun add hono@latest, or pnpm update hono.
  3. Audit application source code for usage of hono/css (css template literals and <Style /> components) that incorporate query parameters, route parameters, headers, or database fields.
  4. If upgrading is blocked, wrap all dynamic string interpolations inside css templates with a helper function that escapes forward slashes (input.replace(/\//g, '\\/')).

References

Read the full report for CVE-2026-126359 on our website for more details including interactive diagrams and full exploit analysis.