CVE-2026-59895: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

July 21, 2026

cx() in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of the class attribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).

References

github.com/advisories/GHSA-w62v-xxxg-mg59
github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc
github.com/honojs/hono/releases/tag/v4.12.27
github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59
nvd.nist.gov/vuln/detail/CVE-2026-59895

Code Behaviors & Features

Detect and mitigate CVE-2026-59895 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →