chore(deps): update dependency hono to v4.12.27 [security]#201
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency hono to v4.12.27 [security]#201renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.12.25→4.12.27hono/jsx does not isolate context per request, leading to cross-request data disclosure
CVE-2026-59896 / GHSA-hvrm-45r6-mjfj
More information
Details
Summary
hono/jsxdid not isolate context values per request during server-side rendering. While an async component was suspended onawait, its provided context value stayed observable to other requests rendering concurrently, souseContext()could return a value from a different in-flight request.Details
During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.
This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:
createContext()/useContext()jsxRenderermiddleware anduseRequestContext()It arises only when context is read after an
awaitinside an async component while requests render concurrently. Reading context synchronously (before anyawait), purely synchronous rendering, and client-side (DOM) rendering are not affected.Impact
Under concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an
awaitmay be evaluated against another user's data.This may lead to:
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
CVE-2026-59895 / GHSA-w62v-xxxg-mg59
More information
Details
Summary
cx()inhono/csscomposes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSXclassattribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of theclassattribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).Details
Because the composed value is treated as pre-escaped, the HTML attribute escaping normally applied to interpolated values is skipped, and characters such as
"pass through unescaped — allowing a value to terminate the attribute and add further attributes or elements. This arises when an application passes untrusted, user-controlled input as a class name tocx(), for example when merging a base class with an externally providedclassName.Impact
During server-side rendering, an attacker who controls a value passed to
cx()can inject arbitrary HTML into the page, resulting in stored or reflected XSS in the victim's browser.This may lead to:
Applications are affected only if they render JSX server-side and pass untrusted input as a class name to
cx().Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
CVE-2026-59897 / GHSA-xgm2-5f3f-mvvc
More information
Details
Summary
The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example,
203.0.113.1is dropped when another value is203.0.113.10).Details
A repeated request header carries an ordered list of values. Middleware or application logic that depends on the complete list — such as IP restriction that walks the
X-Forwarded-Forchain, rate limiting, audit logging, or proxy-chain validation — can therefore receive incomplete data that differs from what the client actually sent.This issue arises on deployments using the AWS API Gateway v1 adapter (the same pattern also affects the VPC Lattice adapter), for requests that contain the same header more than once.
Impact
An attacker can craft repeated header values so that one value is omitted before the application sees the request. Where a security or routing decision relies on the full chain, this can alter that decision.
This affects applications deployed through Hono's AWS API Gateway v1 (or VPC Lattice) adapter that rely on the complete set of repeated request header values.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.12.27Compare Source
Security fixes
This release includes fixes for the following security issues:
hono/jsx does not isolate context per request
Affects:
hono/jsx,hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, souseContext()/useRequestContext()read after anawaitin an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfjServer-Side XSS via JSX escaping bypass in cx()
Affects:
hono/css.cx()marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSXclassattribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59API Gateway v1 adapter can drop a repeated request header value
Affects:
hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g.203.0.113.1dropped when203.0.113.10is present) — affecting logic such asX-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvcUsers of
hono/jsx/hono/jsx-renderer,hono/css(cx()), or thehono/aws-lambdaAPI Gateway v1 / VPC Lattice adapters are encouraged to upgrade.v4.12.26Compare Source
What's Changed
Full Changelog: honojs/hono@v4.12.25...v4.12.26
Configuration
📅 Schedule: (in timezone Australia/Melbourne)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.