chore(deps): update dependency hono to v4.12.34 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	>=4.12.27 → >=4.12.34
hono (source)	4.12.33 → 4.12.34

---

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207 / GHSA-8j4g-w8fx-2239

More information

Details

Summary

The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.

Details

On a CORS preflight, when allowHeaders is not configured - the default - the middleware reflects and parses the Access-Control-Request-Headers value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.

Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.

This issue arises for any application using cors() with the default (or an empty) allowHeaders. Applications that set a non-empty allowHeaders do not reach the affected path.

Impact

An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
• https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-8j4g-w8fx-2239

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848 / GHSA-54fx-42gc-7vw4

More information

Details

Summary

The languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags.

Details

To implement progressive language-tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix. The total amount of string processing grows quadratically with the number of subtags.

Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration. The default detector order enables query-string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests.

Request-size limits reduce the maximum cost of a single request but do not eliminate the issue. Inputs accepted by common JavaScript runtimes can still cause noticeable synchronous event-loop blocking.

Impact

An attacker may repeatedly send requests containing long, hyphen-separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed.

The practical impact depends on the runtime's request-size limits, reverse-proxy configuration, and the detectors enabled by the application.

Resolution

The progressive lookup should avoid reconstructing every shorter prefix. The implementation can instead inspect the configured supported languages and select the longest value that matches the input at a hyphen boundary.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4
• https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-54fx-42gc-7vw4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Proxy Helper does not remove response headers listed in the Connection header

CVE-2026-71849 / GHSA-79qm-7rj5-m7r9

More information

Details

Summary

The Proxy Helper (hono/proxy) does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients.

Details

Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well-known hop-by-hop headers. The proxy() function removed the well-known hop-by-hop headers (including Connection itself) from origin responses, but did not remove the headers that the response's Connection header field designated as connection-scoped.

This issue arises when an application proxies responses from an origin that declares additional, non-standard headers as hop-by-hop via the Connection response header.

Impact

A client may receive response headers that the origin intended only for its immediate peer. This may lead to:

• Disclosure of connection-scoped or internal metadata contained in such headers

This issue affects applications that use the Proxy Helper (hono/proxy) to forward responses from origins that list custom header names in their Connection response header. Applications whose origins only use the standard hop-by-hop headers are not affected.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
• https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-79qm-7rj5-m7r9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: memo() retains SSR output across requests, leading to cross-user data disclosure

CVE-2026-71850 / GHSA-f23p-vx2j-j53r

More information

Details

Summary

memo() from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request.

Details

Components wrapped with memo() are compared by props alone. Values read implicitly during rendering do not participate: JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage. The retained result lives as long as the wrapped component, so it outlives the request that produced it.

Per-request context isolation is not what fails: the current request's values are established correctly, but the memoized component is skipped before anything reads them.

This issue arises when a component wrapped in memo() obtains user- or request-specific data from an ambient context instead of through props.

Impact

A user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.

This may lead to:

• Disclosure of another user's account or profile data
• Disclosure of request-scoped secrets embedded in HTML, such as CSRF tokens
• Exposure of role-specific content to users who should not receive it

Exploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.

This issue affects applications that render with hono/jsx on the server and wrap a component reading ambient request state in memo(). Applications that pass all request-specific values through props, or that do not use memo(), are unaffected. Client-side rendering is unaffected.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
• https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-f23p-vx2j-j53r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.12.34

Compare Source

v4.12.33

Compare Source

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #​5164
• chore: bump @hono/node-server in #​5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
• chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

• ci: enable reports for type & bundle size check in #​5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
• fix(sse): emit empty id field to reset Last-Event-ID in #​5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
• fix: use Object.create(null) when parsing query, headers, and params in #​5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

Compare Source

v4.12.30

Compare Source

What's Changed

• chore(benchmark/routers): bump deps in #​5107
• chore(benchmark): remove not used benchmarks in #​5108
• chore: update to ts6 in prep for ts7 in #​5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
• fix(compress): do not compress 206 Partial Content responses in #​5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

Compare Source

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in #​5092
• chore: fix no-op tsc in test script by @​yusukebe in #​5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in #​5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in #​5081
• test(workerd): add compatibilityDate by @​yusukebe in #​5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in #​5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in #​5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in #​5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in #​5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in #​5084

New Contributors

• @​codebybilal18 made their first contribution in #​5081
• @​Arman-Luthra made their first contribution in #​5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in #​5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in #​5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in #​5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in #​5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in #​5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in #​5059
• chore: bump devDependencies by @​yusukebe in #​5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in #​5033
• docs(context-storage): fix JSDoc by @​yusukebe in #​5086

New Contributors

• @​EduardF1 made their first contribution in #​5047
• @​greymoth-jp made their first contribution in #​5059
• @​VihaanAgarwal made their first contribution in #​5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[h4yfans]

Superseded by #1356 (merged as a0177e1de), which lands this together with the other bot dependency bumps in one lockfile regenerated against current main. This PR was 160+ commits behind, so merging it directly risked a lockfile that no longer matched the manifests.

Verified on main: hono 4.13.1, ip-address 10.5.0, nanoid 5.1.16, prettier 3.9.6, motion 12.34.0.