Update npm package hono to v4.12.34 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.25 → 4.12.34

---

hono/jsx does not isolate context per request, leading to cross-request data disclosure

CVE-2026-59896 / GHSA-hvrm-45r6-mjfj

More information

Details

Summary

hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext() could return a value from a different in-flight request.

Details

During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.

This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:

• createContext() / useContext()
• the jsxRenderer middleware and useRequestContext()

It arises only when context is read after an await inside an async component while requests render concurrently. Reading context synchronously (before any await), purely synchronous rendering, and client-side (DOM) rendering are not affected.

Impact

Under concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an await may be evaluated against another user's data.

This may lead to:

• disclosure of rendered output intended for another user
• authorization decisions made with the wrong request's context
• cross-request mixing of session or other request-scoped state

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj
• https://nvd.nist.gov/vuln/detail/CVE-2026-59896
• https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f
• https://github.com/honojs/hono/releases/tag/v4.12.27
• https://github.com/advisories/GHSA-hvrm-45r6-mjfj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

CVE-2026-59897 / GHSA-xgm2-5f3f-mvvc

More information

Details

Summary

The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example, 203.0.113.1 is dropped when another value is 203.0.113.10).

Details

A repeated request header carries an ordered list of values. Middleware or application logic that depends on the complete list — such as IP restriction that walks the X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation — can therefore receive incomplete data that differs from what the client actually sent.

This issue arises on deployments using the AWS API Gateway v1 adapter (the same pattern also affects the VPC Lattice adapter), for requests that contain the same header more than once.

Impact

An attacker can craft repeated header values so that one value is omitted before the application sees the request. Where a security or routing decision relies on the full chain, this can alter that decision.

This affects applications deployed through Hono's AWS API Gateway v1 (or VPC Lattice) adapter that rely on the complete set of repeated request header values.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc
• https://nvd.nist.gov/vuln/detail/CVE-2026-59897
• https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd
• https://github.com/honojs/hono/releases/tag/v4.12.27
• https://github.com/advisories/GHSA-xgm2-5f3f-mvvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

CVE-2026-59895 / GHSA-w62v-xxxg-mg59

More information

Details

Summary

cx() in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of the class attribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).

Details

Because the composed value is treated as pre-escaped, the HTML attribute escaping normally applied to interpolated values is skipped, and characters such as " pass through unescaped — allowing a value to terminate the attribute and add further attributes or elements. This arises when an application passes untrusted, user-controlled input as a class name to cx(), for example when merging a base class with an externally provided className.

Impact

During server-side rendering, an attacker who controls a value passed to cx() can inject arbitrary HTML into the page, resulting in stored or reflected XSS in the victim's browser.

This may lead to:

• Execution of attacker-controlled script in the victim's browser session.
• Session hijacking, credential theft, or actions performed on behalf of the victim.

Applications are affected only if they render JSX server-side and pass untrusted input as a class name to cx().

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59
• https://nvd.nist.gov/vuln/detail/CVE-2026-59895
• https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc
• https://github.com/honojs/hono/releases/tag/v4.12.27
• https://github.com/advisories/GHSA-w62v-xxxg-mg59

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848 / GHSA-54fx-42gc-7vw4

More information

Details

Summary

The languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags.

Details

To implement progressive language-tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix. The total amount of string processing grows quadratically with the number of subtags.

Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration. The default detector order enables query-string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests.

Request-size limits reduce the maximum cost of a single request but do not eliminate the issue. Inputs accepted by common JavaScript runtimes can still cause noticeable synchronous event-loop blocking.

Impact

An attacker may repeatedly send requests containing long, hyphen-separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed.

The practical impact depends on the runtime's request-size limits, reverse-proxy configuration, and the detectors enabled by the application.

Resolution

The progressive lookup should avoid reconstructing every shorter prefix. The implementation can instead inspect the configured supported languages and select the longest value that matches the input at a hyphen boundary.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4
• https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-54fx-42gc-7vw4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Proxy Helper does not remove response headers listed in the Connection header

CVE-2026-71849 / GHSA-79qm-7rj5-m7r9

More information

Details

Summary

The Proxy Helper (hono/proxy) does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients.

Details

Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well-known hop-by-hop headers. The proxy() function removed the well-known hop-by-hop headers (including Connection itself) from origin responses, but did not remove the headers that the response's Connection header field designated as connection-scoped.

This issue arises when an application proxies responses from an origin that declares additional, non-standard headers as hop-by-hop via the Connection response header.

Impact

A client may receive response headers that the origin intended only for its immediate peer. This may lead to:

• Disclosure of connection-scoped or internal metadata contained in such headers

This issue affects applications that use the Proxy Helper (hono/proxy) to forward responses from origins that list custom header names in their Connection response header. Applications whose origins only use the standard hop-by-hop headers are not affected.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
• https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-79qm-7rj5-m7r9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: memo() retains SSR output across requests, leading to cross-user data disclosure

CVE-2026-71850 / GHSA-f23p-vx2j-j53r

More information

Details

Summary

memo() from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request.

Details

Components wrapped with memo() are compared by props alone. Values read implicitly during rendering do not participate: JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage. The retained result lives as long as the wrapped component, so it outlives the request that produced it.

Per-request context isolation is not what fails: the current request's values are established correctly, but the memoized component is skipped before anything reads them.

This issue arises when a component wrapped in memo() obtains user- or request-specific data from an ambient context instead of through props.

Impact

A user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.

This may lead to:

• Disclosure of another user's account or profile data
• Disclosure of request-scoped secrets embedded in HTML, such as CSRF tokens
• Exposure of role-specific content to users who should not receive it

Exploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.

This issue affects applications that render with hono/jsx on the server and wrap a component reading ambient request state in memo(). Applications that pass all request-specific values through props, or that do not use memo(), are unaffected. Client-side rendering is unaffected.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
• https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-f23p-vx2j-j53r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.12.34

Compare Source

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

Compare Source

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #​5164
• chore: bump @hono/node-server in #​5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
• chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

• ci: enable reports for type & bundle size check in #​5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
• fix(sse): emit empty id field to reset Last-Event-ID in #​5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
• fix: use Object.create(null) when parsing query, headers, and params in #​5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

Compare Source

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in #​5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in #​5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in #​5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in #​5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in #​5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in #​5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in #​5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

Compare Source

What's Changed

• chore(benchmark/routers): bump deps in #​5107
• chore(benchmark): remove not used benchmarks in #​5108
• chore: update to ts6 in prep for ts7 in #​5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
• fix(compress): do not compress 206 Partial Content responses in #​5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

Compare Source

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in #​5092
• chore: fix no-op tsc in test script by @​yusukebe in #​5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in #​5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in #​5081
• test(workerd): add compatibilityDate by @​yusukebe in #​5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in #​5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in #​5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in #​5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in #​5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in #​5084

New Contributors

• @​codebybilal18 made their first contribution in #​5081
• @​Arman-Luthra made their first contribution in #​5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in #​5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in #​5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in #​5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in #​5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in #​5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in #​5059
• chore: bump devDependencies by @​yusukebe in #​5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in #​5033
• docs(context-storage): fix JSDoc by @​yusukebe in #​5086

New Contributors

• @​EduardF1 made their first contribution in #​5047
• @​greymoth-jp made their first contribution in #​5059
• @​VihaanAgarwal made their first contribution in #​5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Compare Source

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

Compare Source

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @​yusukebe in #​5013
• ci: publish to npm from CI with OIDC trusted publishing by @​yusukebe in #​5028
• chore: remove unused devcontainer and gitpod configs by @​yusukebe in #​5029
• chore: replace arg and glob with Bun native APIs in build script by @​yusukebe in #​5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cursor]

PR Summary

Low Risk
Lockfile-only version pin with no application code changes; reduces known security issues in a transitive dependency.

Overview
Pins hono from 4.12.25 to 4.12.34 via the root package.json overrides entry and refreshes package-lock.json so the whole dependency tree resolves to the newer release.

This is a security-driven dependency bump (Renovate targets at least 4.12.27 for published fixes). The upgraded line addresses SSR hono/jsx cross-request context leakage, cx() SSR escaping/XSS, and AWS API Gateway v1 repeated-header deduplication issues. Brunch does not import hono directly; the override mainly affects transitive consumers (e.g. packages that pull in hono / @hono/node-server).

^{Reviewed by Cursor Bugbot for commit 870cf72. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

package-lock.json

Name	Version	Vulnerability	Severity	Patched Version
hono	4.12.27	Hono: ReDoS in CORS middleware via Access-Control-Request-Headers	moderate	4.12.34

OpenSSF Scorecard

Package	Version	Score	Details
npm/hono	4.12.27	Unknown	Unknown
npm/balanced-match	4.0.4	🟢 5.8	Details Check Score Reason Code-Review 🟢 3 Found 4/13 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/brace-expansion	5.0.9	🟢 7.2	Details Check Score Reason Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 10 all dependencies are pinned Code-Review 🟢 3 Found 5/16 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 26 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json