CVE-2026-84363: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in honojs hono

The vulnerability in Hono (CVE-2026-84363) arises because query helpers treat a question mark after a literal hash fragment as the start of a query string, allowing parameters that other components do not observe to influence application behavior. The Cache Middleware removes the fragment when building cache keys, causing responses influenced by these hidden parameters to be cached under keys that omit them. This discrepancy can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting if affected parameters are reflected in cached HTML without proper escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL. The flaw is fixed in Hono version 4.13.5.

This vulnerability can lead to cache poisoning and stored cross-site scripting attacks by allowing hidden query parameters to influence cached responses without being detected by intermediaries or security controls. It bypasses filtering and auditing mechanisms, potentially exposing users to malicious content. However, exploitation depends on the environment preserving the literal hash character in URLs, limiting the attack surface. There is no impact on confidentiality or availability reported.

A fix is available in Hono version 4.13.5. Users and administrators should upgrade to this version to resolve the issue. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; verify with the vendor advisory for confirmation. No additional mitigation steps are indicated.