CVE-2026-84363: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

September 8, 2026

Hono’s query parsing does not stop at the URL fragment: a ? appearing after a # is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.

References

github.com/advisories/GHSA-crvj-82cr-hjcx
github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc
github.com/honojs/hono/releases/tag/v4.13.5
github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx
nvd.nist.gov/vuln/detail/CVE-2026-84363

Code Behaviors & Features

Detect and mitigate CVE-2026-84363 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →