{"action":"Upgrade hono to 4.12.27 or later.","affected":[{"fixed":"4.12.27","introduced":"4.0.0"}],"component":"hono","cve_ids":["CVE-2026-59895"],"ecosystem":"npm","epss":0.00327,"exploited":false,"fixed_versions":["4.12.27"],"ghsa_id":"GHSA-w62v-xxxg-mg59","id":"tcs_01M5KGE4PY4MQ5P1FCW60TRTR3","modified_at":"2026-09-10T03:51:12.371507758Z","published_at":"2026-07-21T18:33:50Z","references":["https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59","https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59","https://nvd.nist.gov/vuln/detail/CVE-2026-59895","https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.12.27"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-w62v-xxxg-mg59","url":"https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59"}],"summary":"Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility"}