CVE-2026-59895: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

July 21, 2026

cx() in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of the class attribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).

References

github.com/advisories/GHSA-w62v-xxxg-mg59
github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc
github.com/honojs/hono/releases/tag/v4.12.27
github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59
nvd.nist.gov/vuln/detail/CVE-2026-59895

Code Behaviors & Features

Detect and mitigate CVE-2026-59895 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →