AIKIDO-2026-658246

TL;DR

Hono's query string parser does not stop at the URL fragment, so a ? that appears after a # is treated as the start of the query string and fragment content is parsed as query parameters. This produces interpretation differences between Hono and upstream proxies, filters, or WAFs, and the cache middleware builds cache keys that drop the fragment. Requests carrying fragment-hidden parameters can bypass upstream controls or collide on cache keys so a cached response is served to unintended users. The fix stops query parsing at the fragment and preserves the fragment when constructing cache keys.