Repository navigation
chore(deps): update dependency hono to v4.13.11 [security] - #90
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Owner
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
renovate
Bot
force-pushed
the
renovate/npm-hono-vulnerability
branch
from
October 30, 2026 07:17
7827543 to
f7614ff
Compare
renovate
Bot
force-pushed
the
renovate/npm-hono-vulnerability
branch
from
November 4, 2026 05:40
f7614ff to
60a714b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
4.12.23→4.13.11hono: AWS Lambda adapter merges multiple
Set-Cookieheaders into one value, dropping cookies on ALB single-header and LatticeCVE-2026-54287 / GHSA-j6c9-x7qj-28xf
More information
Details
Summary
On AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple
Set-Cookieheaders into one comma-separated value. Because commas also appear inside cookie attributes (for exampleExpiresdates), clients cannot split the value back into individual cookies and silently drop or misparse them.Details
Per RFC 6265, each cookie must be its own
Set-Cookieheader line, and commas may appear inside attribute values. Joining cookies with", "collides with those commas, producing a value that clients cannot reliably split. Only ALB single-header mode and VPC Lattice v2 are affected; API Gateway v1/v2 and ALB with multi-value headers enabled already use an array and are unaffected.Impact
A client may receive only one of the cookies, a malformed cookie, or none. Session, CSRF, or preference cookies can silently fail to apply, breaking sessions or forcing re-authentication. This affects applications that set multiple cookies per response and run on AWS Lambda behind an ALB in single-header mode (the default) or VPC Lattice v2.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Path traversal in
serve-staticon Windows via encoded backslash (%5C)CVE-2026-54286 / GHSA-wwfh-h76j-fc44
More information
Details
Summary
On Windows hosts, an encoded backslash (
%5C) in the request path decodes to\, which the Windows path resolver treats as a separator.serve-staticthen resolves a single URL segment such asadmin\secret.txtinto a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.Details
The router splits paths only on
/, so/admin%5Csecret.txtis one segment and middleware on/admin/*does not run. Theserve-staticguard rejects./..and consecutive separators but lets a lone\through; on Windows the file resolver re-splits it into the protected subtree.This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.
Impact
An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: CORS Middleware reflects any Origin with credentials when
origindefaults to the wildcardCVE-2026-54290 / GHSA-88fw-hqm2-52qc
More information
Details
Summary
With
credentials: trueand no explicitorigin(the default wildcard), the CORS Middleware reflects the request'sOriginand sendsAccess-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.Details
The spec forbids
Access-Control-Allow-Origin: *with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the requestOrigininstead, so it now succeeds for every origin, includingnull. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.This issue arises when an application enables
credentials: trueand leavesoriginunset or set to the wildcard.Impact
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting
origin.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
CVE-2026-54289 / GHSA-wgpf-jwqj-8h8p
More information
Details
Summary
On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with
Headers.setinstead ofHeaders.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such asX-Forwarded-For,Forwarded, andViaare silently truncated to a single value.Details
A repeated request header carries an ordered list of values. The adapter iterates the list but overwrites on each step, keeping only the final value. Middleware that depends on the full list — for example IP restriction that walks the
X-Forwarded-Forchain, or auditing based onForwarded/Viahops — receives incomplete data. The API Gateway adapter already appends repeated values and is not affected.This issue arises only on Lambda@Edge deployments, for requests that contain the same header more than once.
Impact
Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the
X-Forwarded-Forchain, this can weaken or alter that decision; for auditing, hop history is lost. This affects applications deployed on AWS Lambda@Edge that rely on multi-value request headers.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating
Content-LengthCVE-2026-54288 / GHSA-rv63-4mwf-qqc2
More information
Details
Summary
The Body Limit Middleware trusts the request's
Content-Lengthheader to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declaredContent-Length, which need not match the actual payload. A client can declare a tinyContent-Lengthwhile sending a much larger body, slipping past the limit.Details
When
Content-Lengthis present andTransfer-Encodingis absent, the middleware compares the declared value against the limit and passes the request through if it is small enough. On standards-based runtimes the transport enforces thatContent-Lengthmatches the body, so this is safe. The Lambda adapters instead reconstruct the request from a buffered payload and copy the client'sContent-Lengthverbatim, so the declared length and the real body size are decoupled.This issue affects applications deployed on AWS Lambda that rely on the Body Limit Middleware to cap request body size.
Impact
The declared body-size limit can be bypassed: a handler reads a payload larger than the configured maximum. Processing the oversized payload (large JSON, multipart, etc.) consumes additional CPU and memory per request. The payload remains bounded by the platform's request size limits, and Lambda isolates invocations, so the impact is increased per-request resource usage rather than full denial of service. This affects applications deployed on AWS Lambda that use the Body Limit Middleware.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono/jsx does not isolate context per request, leading to cross-request data disclosure
CVE-2026-59896 / GHSA-hvrm-45r6-mjfj
More information
Details
Summary
hono/jsxdid not isolate context values per request during server-side rendering. While an async component was suspended onawait, its provided context value stayed observable to other requests rendering concurrently, souseContext()could return a value from a different in-flight request.Details
During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.
This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:
createContext()/useContext()jsxRenderermiddleware anduseRequestContext()It arises only when context is read after an
awaitinside an async component while requests render concurrently. Reading context synchronously (before anyawait), purely synchronous rendering, and client-side (DOM) rendering are not affected.Impact
Under concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an
awaitmay be evaluated against another user's data.This may lead to:
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
CVE-2026-59897 / GHSA-xgm2-5f3f-mvvc
More information
Details
Summary
The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted (for example,
203.0.113.1is dropped when another value is203.0.113.10).Details
A repeated request header carries an ordered list of values. Middleware or application logic that depends on the complete list — such as IP restriction that walks the
X-Forwarded-Forchain, rate limiting, audit logging, or proxy-chain validation — can therefore receive incomplete data that differs from what the client actually sent.This issue arises on deployments using the AWS API Gateway v1 adapter (the same pattern also affects the VPC Lattice adapter), for requests that contain the same header more than once.
Impact
An attacker can craft repeated header values so that one value is omitted before the application sees the request. Where a security or routing decision relies on the full chain, this can alter that decision.
This affects applications deployed through Hono's AWS API Gateway v1 (or VPC Lattice) adapter that rely on the complete set of repeated request header values.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
CVE-2026-59895 / GHSA-w62v-xxxg-mg59
More information
Details
Summary
cx()inhono/csscomposes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSXclassattribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break out of theclassattribute and inject arbitrary markup, leading to Cross-Site Scripting (XSS).Details
Because the composed value is treated as pre-escaped, the HTML attribute escaping normally applied to interpolated values is skipped, and characters such as
"pass through unescaped — allowing a value to terminate the attribute and add further attributes or elements. This arises when an application passes untrusted, user-controlled input as a class name tocx(), for example when merging a base class with an externally providedclassName.Impact
During server-side rendering, an attacker who controls a value passed to
cx()can inject arbitrary HTML into the page, resulting in stored or reflected XSS in the victim's browser.This may lead to:
Applications are affected only if they render JSX server-side and pass untrusted input as a class name to
cx().Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207 / GHSA-8j4g-w8fx-2239
More information
Details
Summary
The built-in CORS middleware (
hono/cors) parses the attacker-controlledAccess-Control-Request-Headersrequest header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.Details
On a CORS preflight, when
allowHeadersis not configured - the default - the middleware reflects and parses theAccess-Control-Request-Headersvalue. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.
This issue arises for any application using
cors()with the default (or an empty)allowHeaders. Applications that set a non-emptyallowHeadersdo not reach the affected path.Impact
An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Algorithmic Complexity DoS in Language Middleware
CVE-2026-71848 / GHSA-54fx-42gc-7vw4
More information
Details
Summary
The
languageDetectormiddleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags.Details
To implement progressive language-tag truncation,
normalizeLanguage()repeatedly callsparts.slice(0, i).join('-')for every possible prefix. The total amount of string processing grows quadratically with the number of subtags.Language values may come from a query parameter, cookie,
Accept-Languageheader, or URL path, depending on the detector configuration. The default detector order enables query-string, cookie, and header detection, so applications usinglanguageDetector()may expose this processing to unauthenticated requests.Request-size limits reduce the maximum cost of a single request but do not eliminate the issue. Inputs accepted by common JavaScript runtimes can still cause noticeable synchronous event-loop blocking.
Impact
An attacker may repeatedly send requests containing long, hyphen-separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed.
The practical impact depends on the runtime's request-size limits, reverse-proxy configuration, and the detectors enabled by the application.
Resolution
The progressive lookup should avoid reconstructing every shorter prefix. The implementation can instead inspect the configured supported languages and select the longest value that matches the input at a hyphen boundary.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Proxy Helper does not remove response headers listed in the
ConnectionheaderCVE-2026-71849 / GHSA-79qm-7rj5-m7r9
More information
Details
Summary
The Proxy Helper (
hono/proxy) does not remove response headers named by the origin'sConnectionheader. Headers that the origin marked as connection-scoped are therefore forwarded to clients.Details
Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's
Connectionheader field before forwarding the message, in addition to the well-known hop-by-hop headers. Theproxy()function removed the well-known hop-by-hop headers (includingConnectionitself) from origin responses, but did not remove the headers that the response'sConnectionheader field designated as connection-scoped.This issue arises when an application proxies responses from an origin that declares additional, non-standard headers as hop-by-hop via the
Connectionresponse header.Impact
A client may receive response headers that the origin intended only for its immediate peer. This may lead to:
This issue affects applications that use the Proxy Helper (
hono/proxy) to forward responses from origins that list custom header names in theirConnectionresponse header. Applications whose origins only use the standard hop-by-hop headers are not affected.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono:
memo()retains SSR output across requests, leading to cross-user data disclosureCVE-2026-71850 / GHSA-f23p-vx2j-j53r
More information
Details
Summary
memo()fromhono/jsxretains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request.Details
Components wrapped with
memo()are compared by props alone. Values read implicitly during rendering do not participate: JSX Context throughcreateContext()anduseContext(),useRequestContext()fromhono/jsx-renderer, andgetContext()fromhono/context-storage. The retained result lives as long as the wrapped component, so it outlives the request that produced it.Per-request context isolation is not what fails: the current request's values are established correctly, but the memoized component is skipped before anything reads them.
This issue arises when a component wrapped in
memo()obtains user- or request-specific data from an ambient context instead of through props.Impact
A user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.
This may lead to:
Exploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.
This issue affects applications that render with
hono/jsxon the server and wrap a component reading ambient request state inmemo(). Applications that pass all request-specific values through props, or that do not usememo(), are unaffected. Client-side rendering is unaffected.Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Unbounded dot-notation nesting in
parseBody()can cause memory exhaustionCVE-2026-84364 / GHSA-g6gw-c38x-mqfc
More information
Details
Summary
When
parseBody()expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.Details
Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could encode one nesting level per byte.
Both shapes produce the effect: a single deeply dotted field name, and a large number of shallowly dotted ones within one body. A request body size limit does not prevent it, because the amplification happens after the body has been accepted.
Dot-notation parsing is not enabled by default.
Impact
An attacker who can reach an endpoint that parses request bodies with dot-notation enabled can send concurrent requests whose memory cost is disproportionate to their size.
This may lead to:
This issue affects applications that explicitly enable dot-notation parsing. Applications using the default behaviour are not affected.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
CVE-2026-84363 / GHSA-crvj-82cr-hjcx
More information
Details
Summary
Hono's query parsing does not stop at the URL fragment: a
?appearing after a#is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.Details
A fragment is never part of the query, and every standard URL consumer — browsers,
new URL(), reverse proxies — ignores everything from the first#onward. Hono's routing followed that rule; its query helpers did not.For one and the same request, this produces an interpretation differential:
The same divergence reaches request validation and any middleware that reads query parameters.
This requires a request target containing a literal
#to reach the application. Deployments on runtimes that normalise such a target — including Cloudflare Workers — are not affected, and neither are those behind an intermediary that strips the fragment.Impact
An attacker can cause the application to act on parameters that components in front of it never observe.
This may lead to:
This issue affects applications that read query parameters and run on a runtime that passes a literal
#through to the request URL.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Incomplete fix for CVE-2026-39408:
toSSG()still writes files outside the output directoryCVE-2026-84365 / GHSA-gqvv-2mrq-wpjv
More information
Details
Summary
The fix released for CVE-2026-39408 does not cover every traversal sequence.
toSSG()can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.Details
Static site generation builds each output path from the route path and the values supplied through
ssgParams, then verifies that the result stays inside the output directory. That check normalizes the path with the same routine that built it, and the routine did not fully collapse runs of consecutive parent-directory segments. A value carrying enough of them produces a path the check accepts, but the filesystem resolves outside the output directory.The earlier fix handled a single parent-directory segment, so it blocks the sequence reported at the time while leaving longer runs unhandled. The check also treated output directories that differ only in how they are rooted as equivalent.
This arises when an application generates a static site from route parameter values it does not fully control — slugs coming from a CMS, an API, or user submissions.
Impact
A value reaching
ssgParamsfrom an untrusted source can cause build output to be written outside the intended output directory, carrying whatever content the route handler produced.This may lead to:
This affects build-time static site generation only; request-time routing is not affected. Applications whose
ssgParamsvalues are entirely developer-controlled are not affected.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
CVE-2026-93981 / GHSA-hxh3-vqpv-xpqv
More information
Details
Summary
hono/jsxdoes not HTML-escape a plain string placed directly as a child orfallbackofSuspenseorErrorBoundary, as the only child of aContext.Provider, or as the root value ofrenderToString()/renderToReadableStream()fromhono/jsx/dom/server. Such a string is emitted as markup instead of text.Details
These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases:
Suspense: a string child, or a stringfallbackwhile a child suspends. With streaming, the fallback reaches the browser in the initial chunk.ErrorBoundary: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5).Context.Provider: a single string child. Multiple children are escaped.hono/jsx/dom/server: a string, or an array containing strings, passed as the root.A lone
{children}forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values fromraw()or thehtmlhelper, and client-side rendering withhono/jsx/domare not affected.Impact
An attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin.
This issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono:
serveStaticdecodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-111757 / GHSA-5r4p-p66f-jhc7
More information
Details
Summary
serveStaticdecodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.Details
Hono decodes the request path once before routing.
serveStaticdecoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.Impact
An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by
serveStatic. Applications that serve only public files are not affected.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: CORS Middleware reflects any Origin with credentials when
origindefaults to the wildcardCVE-2026-54290 / GHSA-88fw-hqm2-52qc
More information
Details
Summary
With
credentials: trueand no explicitorigin(the default wildcard), the CORS Middleware reflects the request'sOriginand sendsAccess-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.Details
The spec forbids
Access-Control-Allow-Origin: *with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the requestOrigininstead, so it now succeeds for every origin, includingnull. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.This issue arises when an application enables
credentials: trueand leavesoriginunset or set to the wildcard.Impact
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting
origin.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
hono: AWS Lambda adapter merges multiple
Set-Cookieheaders into one value, dropping cookies on ALB single-header and LatticeCVE-2026-54287 / GHSA-j6c9-x7qj-28xf
More information
Details
Summary
On AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple
Set-Cookieheaders into one comma-separated value. Because commas also appear inside cookie attributes (for exampleExpiresdates), clients cannot split the value back into individual cookies and silently drop or misparse them.Details
Per RFC 6265, each cookie must be its own
Set-Cookieheader line, and commas may appear inside attribute values. Joining cookies with", "collides with those commas, producing a value that clients cannot reliably split. Only ALB single-header mode and VPC Lattice v2 are affected; API Gateway v1/v2 and ALB with multi-value headers enabled already use an array and are unaffected.Impact
A client may receive only one of the cookies, a malformed cookie, or none. Session, CSRF, or preference cookies can silently fail to apply, breaking sessions or forcing re-authentication. This affects applications that set multiple cookies per response and run on AWS Lambda behind an ALB in single-header mode (the default) or VPC Lattice v2.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating
Content-LengthCVE-2026-54288 / GHSA-rv63-4mwf-qqc2
More information
Details
Summary
The Body Limit Middleware trusts the request's
Content-Lengthheader to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declaredContent-Length, which need not match the actual payload. A client can declare a tinyContent-Lengthwhile sending a much larger body, slipping past the limit.Details
When
Content-Lengthis present andTransfer-Encodingis absent, the middleware compares the declared value against the limit and passes the request through if it is small enough. On standards-based runtimes the transport enforces thatContent-Lengthmatches the body, so this is safe. The Lambda adapters instead reconstruct the request from a buffered payload and copy the client'sContent-Lengthverbatim, so the declared length and the real body size are decoupled.This issue affects applications deployed on AWS Lambda that rely on the Body Limit Middleware to cap request body size.
Impact
The declared body-size limit can be bypassed: a handler reads a payload larger than the configured maximum. Processing the oversized payload (large JSON, multipart, etc.) consumes additional CPU and memory per request. The payload remains bounded by the platform's request size limits, and Lambda isolates invocations, so the impact is increased per-request resource usage rather than full denial of service. This affects applications deployed on AWS Lambda that use the Body Limit Middleware.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
CVE-2026-54289 / GHSA-wgpf-jwqj-8h8p
More information
Details
Summary
On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with
Headers.setinstead ofHeaders.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such asX-Forwarded-For,Forwarded, andViaare silently truncated to a single value.Details
A repeated request header carries an ordered list of values. The adapter iterates the list but overwrites on each step, keeping only the final value. Middleware that depends on the full list — for example IP restriction that walks the
X-Forwarded-Forchain, or auditing based onForwarded/Viahops — receives incomplete data. The API Gateway adapter already appends repeated values and is not affected.This issue arises only on Lambda@Edge deployments, for requests that contain the same header more than once.
Impact
Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the
X-Forwarded-Forchain, this can weaken or alter that decision; for auditing, hop history is lost. This affects applications deployed on AWS Lambda@Edge that rely on multi-value request headers.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
hono: Path traversal in
serve-staticon Windows via encoded backslash (%5C)CVE-2026-54286 / GHSA-wwfh-h76j-fc44
More information
Details
Summary
On Windows hosts, an encoded backslash (
%5C) in the request path decodes to\, which the Windows path resolver treats as a separator.serve-staticthen resolves a single URL segment such asadmin\secret.txtinto a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.Details
The router splits paths only on
/, so/admin%5Csecret.txtis one segment and middleware on/admin/*does not run. Theserve-staticguard rejects./..and consecutive separators but lets a lone\through; on Windows the file resolver re-splits it into the protected subtree.This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.
Impact
An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
hono/jsx does not isolate context per request, leading to cross-request data disclosure
CVE-2026-59896 / GHSA-hvrm-45r6-mjfj
More information
Details
Summary
hono/jsxdid not isolate context values per request during server-side rendering. While an async component was suspended onawait, its provided context value stayed observable to other requests rendering concurrently, souseContext()could return a value from a different in-flight request.Details
During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.
This affects the usual ways request-scoped data is