CVE-2026-29085: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29085 is an SSE (Server-Sent Events) control field injection vulnerability in the Hono web framework's streamSSE() Streaming Helper, caused by insufficient validation of CR/LF characters in the event, id, and retry fields. It affects all Hono versions before 4.12.4 on Node.js. The vulnerability was disclosed on March 3, 2026, by researcher TarPeg007 and published to the GitHub Advisory Database on March 4, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is improper neutralization of special elements (CWE-74): the writeSSE() function in Hono's SSE helper built event frames by joining lines with \n but did not reject embedded carriage return (\r) or newline (\n) characters in the event, id, and retry control fields. Because the SSE protocol uses line breaks as field delimiters, an attacker who can supply user-controlled input to these fields can inject additional SSE fields (e.g., data:, id:, retry:) into the event stream. The fix, applied in commit f4123ed, adds a validation check that throws an error if any of these fields contain \r or \n characters (Github Advisory, Patch Commit). Exploitation requires no authentication and no user interaction, but does require the application to pass user-controlled input directly into the affected SSE fields.

Successful exploitation allows a network attacker to manipulate the structure of SSE event frames, injecting arbitrary SSE fields into the event stream received by connected clients. If the application renders e.data using unsafe DOM methods such as innerHTML, this can escalate to client-side script injection (XSS), potentially compromising confidentiality and integrity of data presented to end users. Availability is not impacted, and the scope is unchanged, limiting the blast radius to the affected application's SSE consumers (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.06% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a vulnerable target: Find a web application built on Hono (npm package hono < 4.12.4) that uses streamSSE() and passes user-controlled input into the event, id, or retry SSE fields.
2. Craft a malicious input: Prepare a payload containing CR (\r) or LF (\n) characters embedded in the value intended for one of the control fields, e.g., event: legitimate\ndata: <script>alert(1)</script>.
3. Submit the payload: Trigger the application endpoint that processes user input and passes it to writeSSE(), for example via an HTTP request parameter, form field, or API call that the server reflects into the SSE stream.
4. Observe injected SSE fields: The SSE event frame received by clients will contain the injected fields, altering event stream handling. If the application renders e.data via innerHTML or similar unsafe methods, the injected script executes in the victim's browser (Github Advisory).

• Network: Unusual HTTP requests to SSE endpoints containing URL-encoded or raw %0A (\n) or %0D (\r) characters in parameters that are reflected into SSE control fields.
• Logs: Server-side application logs showing errors such as event must not contain "\r" or "\n" (if upgraded to 4.12.4) or unexpected SSE frames with multiple field lines in a single event in access/debug logs.
• Client-Side: Browser console errors or unexpected script execution originating from SSE data: fields; DOM mutations triggered by innerHTML assignments from SSE event data.

Upgrade Hono to version 4.12.4 or later, which rejects CR/LF characters in the event, id, and retry SSE fields by throwing an error at the point of writeSSE() invocation (Github Advisory, Patch Commit). For applications that cannot immediately upgrade, implement server-side input validation to strip or reject \r and \n characters from any user-controlled data before passing it to SSE control fields. Additionally, ensure that e.data is never rendered using innerHTML or other unsafe DOM methods — use textContent or equivalent safe alternatives to prevent client-side script injection even if injection occurs. IBM products incorporating Hono (IBM DevOps Solution Workbench, IBM API Connect, IBM watsonx Orchestrate) have separate advisories with their own patch timelines (IBM DevOps Advisory, IBM API Connect Advisory).

The vulnerability was reported by researcher TarPeg007 and published by Hono maintainer yusukebe via a GitHub Security Advisory on March 3, 2026. IBM subsequently issued multiple advisories acknowledging the impact on IBM DevOps Solution Workbench, IBM API Connect, and IBM watsonx Orchestrate products that bundle Hono (IBM DevOps Advisory, IBM API Connect Advisory, IBM watsonx Advisory). No significant broader media coverage or notable community controversy has been observed.