UpHeron
All vulnerabilities

npm

CVE-2026-44458

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

Severity
Medium 4.3
Published
9 May 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.12.18
Also known as
GHSA-qp7p-654g-cw7p
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
hononpm · osv:npm:hono
  • Every version before 4.12.18

References