The vulnerability allows query parameters placed after a literal hash fragment to be parsed as part of the request by Hono’s query helpers, even though browsers and many intermediaries normally ignore such parameters. This permits an attacker to inject data that bypasses filtering, logging, and cache‑key construction. If the reflected query string is used in a cached response, the attacker can poison the cache or deliver stored cross‑site scripting content, creating a persistent XSS vector. The weakness is categorized as CWE‑444.

All installations of the honojs:hono framework running any version older than 4.13.5 on any JavaScript runtime that forwards literal hash fragments containing a question mark to the application are affected. Deployments that strip fragments before reaching Hono, such as those on Cloudflare Workers, are not affected.

The CVSS score of 5.9 indicates medium severity, and the CVE is not listed in the CISA KEV catalog. The EPSS score is not available, implying no current data on exploit probability. Exploitation requires an attacker to send a crafted URL that includes a hash fragment immediately followed by a question mark to the vulnerable application via a path that preserves that fragment. Once this condition is met, the attacker can manipulate the cache key and inject persistent cross‑site scripting payloads into responses served to other users.