UpHeron
All vulnerabilities

npm

CVE-2026-44455

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

Severity
Medium 4.7
Published
6 May 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.12.16
Also known as
GHSA-69xw-7hcm-h432
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
hononpm · osv:npm:hono
  • Every version before 4.12.16

References