chore(deps): update dependency hono to v4.12.34 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.31 → 4.12.34
hono (source)	^4.12.31 → ^4.12.34

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

---

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207 / GHSA-8j4g-w8fx-2239

More information

Details

Summary

The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.

Details

On a CORS preflight, when allowHeaders is not configured - the default - the middleware reflects and parses the Access-Control-Request-Headers value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.

Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.

This issue arises for any application using cors() with the default (or an empty) allowHeaders. Applications that set a non-empty allowHeaders do not reach the affected path.

Impact

An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
• https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-8j4g-w8fx-2239

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.12.34

Compare Source

v4.12.33

Compare Source

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #​5164
• chore: bump @hono/node-server in #​5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
• chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

• ci: enable reports for type & bundle size check in #​5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
• fix(sse): emit empty id field to reset Last-Event-ID in #​5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
• fix: use Object.create(null) when parsing query, headers, and params in #​5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.31%. Comparing base (080065a) to head (497cdde).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10347   +/-   ##
=======================================
  Coverage   92.31%   92.31%           
=======================================
  Files         939      939           
  Lines      114824   114824           
  Branches    27731    27731           
=======================================
  Hits       105997   105997           
  Misses       7527     7527           
  Partials     1300     1300           

Flag	Coverage Δ
backend	95.72% <ø> (ø)
control-plane	100.00% <ø> (ø)
engine	74.26% <ø> (ø)
rees	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	497cdde	Commit Preview URL Branch Preview URL	Aug 04 2026, 11:02 PM