[GHSA] GHSA-crvj-82cr-hjcx (medium) — Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

GHSA-crvj-82cr-hjcx Severity: medium CVE: CVE-2026-84363

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

### Summary

Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start of a query string. As a result, the application can read request parameters that no other component inv