CVE-2026-84363: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

September 8, 2026

Hono’s query parsing does not stop at the URL fragment: a ? appearing after a # is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.

References

github.com/advisories/GHSA-crvj-82cr-hjcx
github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc
github.com/honojs/hono/releases/tag/v4.13.5
github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx
nvd.nist.gov/vuln/detail/CVE-2026-84363

Code Behaviors & Features

Detect and mitigate CVE-2026-84363 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →