The vulnerability resides in Hono’s Streaming Helper function writeSSE(), which failed to escape carriage return and newline characters in the event, id, and retry fields. Because Server‑Sent Events rely on line breaks to separate fields, an attacker could inject malicious or additional fields into the same event frame. This flaw allows arbitrary field injection that could manipulate client‑side processing or reveal sensitive data, thereby compromising the confidentiality and integrity of the application data stream.

Hono, the open‑source web framework for JavaScript, supported on any Node.js runtime. Versions prior to 4.12.4 are affected; the issue was patched in 4.12.4.

The CVSS score of 6.5 reflects a moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring an attacker to supply untrusted input to any of the SSE fields in a client‑facing endpoint. Exploitation would need the ability to influence these fields, such as through a form submission or API request, allowing the attacker to inject additional SSE directives.