CVE-2026-44455: hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

May 6, 2026 (updated May 14, 2026)

Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output.

When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML.

References

github.com/advisories/GHSA-69xw-7hcm-h432
github.com/honojs/hono/security/advisories/GHSA-69xw-7hcm-h432
nvd.nist.gov/vuln/detail/CVE-2026-44455

Code Behaviors & Features

Detect and mitigate CVE-2026-44455 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →