Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

Original source

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

Original source

What's Changed

• fix(request): handle params on unmatched requests in #5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in #5266
• perf(router): share null object creation in #5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in #5222
• fix(client): skip undefined header and cookie values in #5244
• fix(client): skip an undefined entry inside a query array in #5272
• fix(client): skip an undefined entry inside a form array in #5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin #5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in #5255
• fix(client): omit empty query delimiter in #5283
• fix(request): drop stale content length for cloned FormData in #5282
• fix(request): serialize cached JSON body in cloneRawRequest in #5288
• fix(cookie): allow parsing signed cookies with empty string values in #5246
• fix(utils/stream): do not let abort listeners crash abort() in #5274

Full Changelog: v4.13.3...v4.13.4

Original source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #5227
• fix(etag): copy pending stream bytes in #5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #5235
• docs(context): add custom headers append option example to Context JSDoc in #5248
• fix(trie-router): match suffix wildcard routes in #5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #5247
• feat(pretty-json): support structured JSON content-types (+json) in #5226

Full Changelog: v4.13.2...v4.13.3

Original source

What's Changed

fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #5197

fix(jsx): render async children of document metadata tags instead of [object Promise] in #5204

fix(etag): resolve incorrect incremental hashing for chunked responses in #5199

fix(client): serialize multiple cookies correctly in #5202

fix(etag): stabilize digest across stream chunks in #5205

fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #5209

perf(cors): pre-join static array header options during initialization in #5210

fix(client): send falsy JSON bodies in #5215

feat(secure-headers): add missing W3C Permissions-Policy directives in #5214

Full Changelog: v4.13.1...v4.13.2

Original source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup ping — GET / 165.83 ns 163.99 ns 1.01x query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x json — GET /user 528.99 ns 422.44 ns 1.25x body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

• perf(context): iterate the header record with for..in #5118
• perf(url): replace regex tests with indexOf #5121
• perf(context): skip Headers creation when there are no headers to merge #5122
• perf(urls): refactor tryDecodeURIComponent #5158
• perf(request): allocate #validatedData lazily #5175
• perf(request): probe the body cache without allocating #5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})

Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
'/search',
cache({
cacheName: 'search-cache',
cacheControl: 'max-age=3600',
})
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @usualoma and @Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'
const app = new Hono()
app.use(methodNotAllowed({ app }))
app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))
// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
methodNotAllowed({
app,
onMethodNotAllowed: (c, methods) =>
c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
})
)

Thanks @usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @usualoma!

Other improvements

hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @akahoshi1421!

The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @arhxam!

JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @ashunar0!

JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @natsuki-engr!

The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @yusukebe in #5113
• perf(context): iterate the header record with for..in by @yusukebe in #5118
• perf(url/request): replace regex tests with indexOf by @yusukebe in #5121
• perf(context): skip Headers creation when there are no headers to merge by @yusukebe in #5122
• perf(urls): refactor tryDecodeURIComponent by @yusukebe in #5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @kibertoad in #5173
• perf(context): drop the throwaway env field initializer by @kibertoad in #5174
• perf(request): allocate #validatedData lazily by @kibertoad in #5175
• perf(request): probe the body cache without allocating by @kibertoad in #5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @yusukebe in #5183
• perf(hono-base): restore the rest parameter in fetch by @yusukebe in #5184
• perf(context): restore the env field initializer by @yusukebe in #5186
• feat: add first-class QUERY method support by @shellhaki in #5070
• feat(etag): support conditional requests for the QUERY method by @Cherry in #5111
• feat(cors): allow QUERY by default as a first-class method by @usualoma in #5115
• feat(cache): add first-class support for QUERY requests by @usualoma in #5119
• feat(jsx): add React-compatible overloads to useRef by @ashunar0 in #5063
• feat(middleware): add method-not-allowed middleware by @usualoma in #5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @arhxam in #5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @akahoshi1421 in #5153
• fix(jsx): allow a function component to return an array by @natsuki-engr in #5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @usualoma in #5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @arhxam in #5137

Full Changelog: v4.12.34...v4.13.0

Thank you to all contributors!

Original source

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

Original source

What's Changed

• ci: enable reports for type & bundle size check in #5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #5142
• fix(sse): emit empty id field to reset Last-Event-ID in #5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #5145
• fix: use Object.create(null) when parsing query, headers, and params in #5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #5147

Full Changelog: v4.12.31...v4.12.32

Original source

What's Changed

• test(context): assert case-insensitive header names in response helpers by @yusukebe in #5116
• chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in #5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in #5130
• fix(utils/body): reuse cached formData in parseBody() by @yusukebe in #5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in #5133
• fix(sse): emit retry feild when retry is 0 by @yusukebe in #5135
• test(validator): fix misspelled identifier in transform type test by @yusukebe in #5136

Full Changelog: v4.12.30...v4.12.31

Original source

What's Changed

• chore(benchmark/routers): bump deps in #5107
• chore(benchmark): remove not used benchmarks in #5108
• chore: update to ts6 in prep for ts7 in #5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #5025
• fix(compress): do not compress 206 Partial Content responses in #5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #5110

Full Changelog: v4.12.29...v4.12.30

Original source

What's Changed

• fix(client): merge function headers with per-request headers by @yusukebe in #5092
• chore: fix no-op tsc in test script by @yusukebe in #5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in #5094
• docs(language): add JSDoc @example to languageDetector by @codebybilal18 in #5081
• test(workerd): add compatibilityDate by @yusukebe in #5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in #5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in #5101
• fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in #5103
• fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in #5102
• fix(etag): treat If-None-Match: * as a match by @yusukebe in #5084

New Contributors

• @codebybilal18 made their first contribution in #5081
• @Arman-Luthra made their first contribution in #5103

Full Changelog: v4.12.28...v4.12.29

Original source

What's Changed

fix(serve-static): treat empty string content as found by @yusukebe in #5062

docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in #5047

chore: don't publish *.tsbuildinfo by @yusukebe in #5066

fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in #5067

fix: avoid circular dependency between body.ts and request.ts by @usualoma in #5071

fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in #5059

chore: bump devDependencies by @yusukebe in #5085

fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in #5033

docs(context-storage): fix JSDoc by @yusukebe in #5086

New Contributors

@EduardF1 made their first contribution in #5047

@greymoth-jp made their first contribution in #5059

@VihaanAgarwal made their first contribution in #5033

Full Changelog: v4.12.27...v4.12.28

Original source