Skip to content

fix(deps): update dependency hono to v4.13.16 [security] - #5426

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-hono-vulnerability
Open

fix(deps): update dependency hono to v4.13.16 [security]#5426
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-hono-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
hono (source) 4.13.7 → 4.13.16 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

CVE-2026-109955 / CVE-2026-111757 / GHSA-5r4p-p66f-jhc7

More information

Details

Summary

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Details

Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Hono: css helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

CVE-2026-126359 / GHSA-3gg2-335m-rxc6

More information

Details

Summary

The css helper in hono/css escapes a / that follows < inside an interpolated value so that a value cannot close the <style> element. The check only looks inside each value. When the text before a value ends with <, whether that is the template itself or an earlier interpolated value, and the next value starts with /, the / is not escaped and the combined output contains an unescaped closing tag.

Details

Interpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes </ therefore cannot see a < that belongs to the template. A template such as a content declaration that opens with a literal < and interpolates a string right after it produces a raw </style> when that string starts with /style>. During server-side rendering the <Style /> element is closed early and the rest of the value is interpreted as HTML.

This issue arises only when < is the last character before an interpolation in a css template, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.

Impact

A client that controls such a value can inject HTML, including script, into the page rendered on the server.

This may lead to:

  • Execution of attacker-controlled script in the browser of a user who views the page
  • Exposure of information available to that page

This issue affects applications that interpolate untrusted strings into a css template immediately after a <, including two adjacent interpolations such as ${prefix}${name} where both are untrusted. Other uses of the css helper are not affected.

Workarounds

Do not interpolate untrusted values into css templates, or make sure the text before an interpolated value does not end with <.

Severity

  • CVSS Score: 3.4 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Hono: csrf() does not check requests sent by hyperlink auditing (text/ping)

CVE-2026-126355 / GHSA-46wx-v44x-9hh2

More information

Details

Summary

csrf() validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing (<a ping>) sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or Sec-Fetch-Site for such a request, so it is passed to the handler.

Details

The middleware skips the origin check when the content type is not one that a form submission produces. The assumption was that any other content type requires a CORS preflight and therefore cannot be sent cross-origin with credentials. Hyperlink auditing is an exception: Chrome and Edge send the ping as a credentialed POST without a preflight, with a fixed body and Content-Type: text/ping.

A page on another origin can therefore trigger a POST to any URL of the application. The csrf() options for origin and secFetchSite do not change the outcome, because neither header is evaluated for the request.

The request body is fixed, so only actions whose effect does not depend on the body can be triggered. Firefox does not send pings by default. As with any CSRF, the user's cookie must be sent with the request, which with the default SameSite=Lax means a same-site origin or a cookie set with SameSite=None.

Impact

A user who visits a malicious page in Chrome or Edge while logged in to an application protected by csrf() can be made to send a state-changing request to that application, such as logging out, deleting a resource, or toggling a setting that is selected by the path or query string.

This issue affects applications that rely on csrf() as their CSRF protection and expose state-changing endpoints whose effect does not depend on the request body.

Workarounds

Reject requests with a Content-Type of text/ping in a middleware registered before csrf(), or set session cookies with SameSite=Strict.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Hono: validator('form') skips validation for multipart/form-data requests with extra parameters

CVE-2026-126356 / GHSA-4h7h-rv7c-7m2v

More information

Details

Summary

validator('form') only recognizes a multipart/form-data Content-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empty object, while c.req.parseBody() still parses the body as a form.

Details

The check that decides whether a request body is a form was written as a strict pattern over the whole Content-Type value. Any parameter list that does not look exactly like ; boundary=... fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can still read all submitted fields through c.req.parseBody() or c.req.formData().

application/x-www-form-urlencoded is not affected. Only the multipart/form-data branch has the strict pattern.

This issue arises when an application relies on validator('form') to reject or restrict fields and the validation callback does not fail on an empty object.

Impact

An unauthenticated client can send form fields that the form validator never sees, by adding a legal parameter to the Content-Type header.

This may lead to:

  • Allow-list or required-field checks in the validator being skipped
  • Fields the application intended to reject reaching the handler

This issue affects applications that use validator('form') with multipart/form-data requests and whose validation callback accepts an empty object.

Workarounds

Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Hono: mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

CVE-2026-126357 / GHSA-4m76-xfj5-7975

More information

Details

Summary

mount() and app.mount() remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on /app/admin/*. The outer application routes on the original path, so the middleware does not run.

Details
  1. Dynamic prefix (all affected versions): for a mount such as /api/:tenant/*, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so /api/a/xxxxx/admin/secret reaches the mounted application as /admin/secret.
  2. Re-normalization (since 4.12.21): the forwarded path was built from the decoded request path and assigned to url.pathname, which turns a decoded backslash into / and collapses ... /app/public%5C..%5Cadmin/secret reaches the mounted application as /admin/secret.

The fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as /assets*. A trailing slash in an app.mount() prefix no longer removes an extra segment.

Impact

An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.

This affects applications that use mount() or app.mount() and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.

Workarounds

Register the authentication middleware inside the mounted application.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

CVE-2026-126358 / GHSA-h7mg-cq63-vhpq

More information

Details

Summary

RegExpRouter, which the default SmartRouter selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it:

  1. Middleware whose parameter is written with the explicit default pattern, such as /api/:tenant{[^/]+}/admin/*, was not applied to a route written as /api/:tenant/admin/:id. (since 4.13.0)
  2. Middleware on /admin/* was not applied to a route registered on /admin* for paths under /admin/. (since 4.1.4)
  3. For a path with an encoded line terminator (%0A, %0D, %E2%80%A8, %E2%80%A9), no wildcard pattern matched, so the request reached the not-found handler without any wildcard middleware. (since 4.4.0)

TrieRouter, LinearRouter and PatternRouter apply the middleware in all three cases.

Details

RegExpRouter decides at registration time which wildcard middleware covers which route. In cases 1 and 2 it treated patterns that match the same requests as different ones. In case 3 the compiled wildcard did not match line terminators.

The fix derives the coverage from the structure of the registered paths and lets wildcards match line terminators. It also corrects other differences from the other routers (a wildcard in the middle of a path with parameters, duplicate middleware, middleware on static routes), and rejects custom patterns that can match the empty string, such as {[0-9]*}, with UnsupportedPathError. PreparedRegExpRouter data must be regenerated.

Impact

An unauthenticated client can reach a route handler, or the not-found handler, without the authentication or authorization middleware registered on a wildcard path.

This affects applications that use RegExpRouter, directly or through the default SmartRouter, and rely on wildcard middleware for authentication or authorization.

Workarounds

Use new Hono({ router: new TrieRouter() }).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

honojs/hono (hono)

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

  • fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

Compare Source

What's Changed

  • docs(contributing): ask for issues instead of RPs #​5526
  • docs(readme): sync the contributing list with CONTRIBUTING.md #​5527
  • fix(adapters): accept Hono v5 prereleases in the hono peer range #​5537
  • chore: unified oxfmt and oxlint config #​5518
  • docs(readme): remove the deepwiki badge #​5548
  • fix(serve-static): only serve GET and HEAD requests #​5514
  • fix(build): keep barrel imports in the bundled d.ts #​5557
  • fix(jsx): preserve self-closing void elements in cloneElement #​5314
  • fix(css): keep "//" inside an unquoted url() when minifying #​5450
  • fix(css): keep the descendant combinator before a pseudo-class when minifying #​5451
  • fix(serve-static): respect q-values in Accept-Encoding for precompressed files #​5436
  • fix(helper/route): match regex params in basePath() the same way as the router #​5498
  • fix(trie-router): keep first value for duplicate path params #​5423
  • fix(hono-base): disallow getPath when strict is false #​5563
  • fix(css): Fix multiline CSS handling in style replacement #​5405
  • feat(bearer-auth): allow MessageFunction to return a Response #​5269
  • fix(utils/url): preserve encoded duplicate query order #​5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in #​5439
  • docs(request): fix jsdoc comments for some getters in #​5445
  • fix(jsx): allow JSXNode function component results in #​5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
  • test(build): type-check the bundled declarations from a consumer project in #​5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
  • chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

  • chore: migrate the package manager from bun to pnpm in #​5433
  • chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
  • chore: replace prettier with oxfmt in #​5435
  • chore(deps): upgrade vitest to 5.0.1 in #​5437
  • chore: let oxfmt sort imports instead of eslint in #​5442
  • chore: replace eslint with oxlint in #​5443
  • chore: introduce Vite+ in #​5444
  • fix(types): allow returning a Blob as a response body in #​5446
  • chore: convert build scripts into plugins in #​5448
  • chore: stop editorconfig-checker from checking Markdown indent size in #​5455
  • ci: remove empty step left in cr.yml by the pnpm migration in #​5456
  • chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
  • feat(adapters): add @​hono/bun as a workspace package in #​5447
  • chore(adapters/bun): ship ESM only in #​5462
  • feat(adapters): add the seven adapters as workspace packages in #​5463
  • feat(adapters/deno): publish to JSR in #​5465
  • test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
  • fix(accepts): match media types and language tags case-insensitively in #​5376
  • fix(linear-router): don't match an empty path segment as a param in #​5373
  • fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
  • fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
  • fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
  • fix(aws-lambda): preserve empty query parameters in #​5292
  • fix(lambda-edge): sync content type detection with aws-lambda in #​5426
  • fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

  • docs: fix typos in code comments and link third-party middleware section in #​5343
  • perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
  • fix(aws-lambda): respect backpressure when streaming the response body in #​5351
  • fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
  • fix(accept): treat the q parameter name as case-insensitive in #​5349
  • fix(accept): clamp a negative q to 0, not 1 in #​5357
  • fix(request): keep the request media type when reusing a cached body in #​5366
  • docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
  • perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

Configuration

📅 Schedule: (in timezone Europe/Zurich)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants