Update dependency hono to v4.12.34 [SECURITY] #134
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
MobiusReactor/TicTacToeV2!134
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/npm-hono-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.12.28→4.12.34Hono: Algorithmic Complexity DoS in Language Middleware
CVE-2026-71848 / GHSA-54fx-42gc-7vw4
More information
Details
Summary
The
languageDetectormiddleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags.Details
To implement progressive language-tag truncation,
normalizeLanguage()repeatedly callsparts.slice(0, i).join('-')for every possible prefix. The total amount of string processing grows quadratically with the number of subtags.Language values may come from a query parameter, cookie,
Accept-Languageheader, or URL path, depending on the detector configuration. The default detector order enables query-string, cookie, and header detection, so applications usinglanguageDetector()may expose this processing to unauthenticated requests.Request-size limits reduce the maximum cost of a single request but do not eliminate the issue. Inputs accepted by common JavaScript runtimes can still cause noticeable synchronous event-loop blocking.
Impact
An attacker may repeatedly send requests containing long, hyphen-separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed.
The practical impact depends on the runtime's request-size limits, reverse-proxy configuration, and the detectors enabled by the application.
Resolution
The progressive lookup should avoid reconstructing every shorter prefix. The implementation can instead inspect the configured supported languages and select the longest value that matches the input at a hyphen boundary.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Hono: Proxy Helper does not remove response headers listed in the
ConnectionheaderCVE-2026-71849 / GHSA-79qm-7rj5-m7r9
More information
Details
Summary
The Proxy Helper (
hono/proxy) does not remove response headers named by the origin'sConnectionheader. Headers that the origin marked as connection-scoped are therefore forwarded to clients.Details
Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's
Connectionheader field before forwarding the message, in addition to the well-known hop-by-hop headers. Theproxy()function removed the well-known hop-by-hop headers (includingConnectionitself) from origin responses, but did not remove the headers that the response'sConnectionheader field designated as connection-scoped.This issue arises when an application proxies responses from an origin that declares additional, non-standard headers as hop-by-hop via the
Connectionresponse header.Impact
A client may receive response headers that the origin intended only for its immediate peer. This may lead to:
This issue affects applications that use the Proxy Helper (
hono/proxy) to forward responses from origins that list custom header names in theirConnectionresponse header. Applications whose origins only use the standard hop-by-hop headers are not affected.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207 / GHSA-8j4g-w8fx-2239
More information
Details
Summary
The built-in CORS middleware (
hono/cors) parses the attacker-controlledAccess-Control-Request-Headersrequest header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.Details
On a CORS preflight, when
allowHeadersis not configured - the default - the middleware reflects and parses theAccess-Control-Request-Headersvalue. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.
This issue arises for any application using
cors()with the default (or an empty)allowHeaders. Applications that set a non-emptyallowHeadersdo not reach the affected path.Impact
An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Hono:
memo()retains SSR output across requests, leading to cross-user data disclosureCVE-2026-71850 / GHSA-f23p-vx2j-j53r
More information
Details
Summary
memo()fromhono/jsxretains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request.Details
Components wrapped with
memo()are compared by props alone. Values read implicitly during rendering do not participate: JSX Context throughcreateContext()anduseContext(),useRequestContext()fromhono/jsx-renderer, andgetContext()fromhono/context-storage. The retained result lives as long as the wrapped component, so it outlives the request that produced it.Per-request context isolation is not what fails: the current request's values are established correctly, but the memoized component is skipped before anything reads them.
This issue arises when a component wrapped in
memo()obtains user- or request-specific data from an ambient context instead of through props.Impact
A user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.
This may lead to:
Exploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.
This issue affects applications that render with
hono/jsxon the server and wrap a component reading ambient request state inmemo(). Applications that pass all request-specific values through props, or that do not usememo(), are unaffected. Client-side rendering is unaffected.Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.12.34Compare Source
Security fixes
This release includes fixes for the following security issues:
memo()retains SSR output across requests, leading to cross-user data disclosureAffects:
hono/jsx(server-side rendering). Fixesmemo()reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context —useContext(),useRequestContext(), orgetContext()— could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53rReDoS in CORS middleware via
Access-Control-Request-HeadersAffects:
hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse theAccess-Control-Request-Headerspreflight header whenallowHeadersis not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239Algorithmic complexity DoS in Language Middleware
Affects:
hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, orAccept-Languageheader — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4Proxy Helper does not remove response headers listed in the
ConnectionheaderAffects:
hono/proxy. Fixesproxy()forwarding response headers that the origin'sConnectionheader designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9Users who use
hono/jsxfor server-side rendering,hono/cors,hono/language, orhono/proxyare strongly encouraged to upgrade to this version.v4.12.33Compare Source
What's Changed
@hono/node-serverin #5167Full Changelog: https://github.com/honojs/hono/compare/v4.12.32...v4.12.33
v4.12.32Compare Source
What's Changed
Object.create(null)when parsing query, headers, and params in #5161Full Changelog: https://github.com/honojs/hono/compare/v4.12.31...v4.12.32
v4.12.31Compare Source
What's Changed
@ts-expect-errorby @yusukebe in #5130parseBody()by @yusukebe in #5131cloneRawRequestby @yusukebe in #51330by @yusukebe in #5135Full Changelog: https://github.com/honojs/hono/compare/v4.12.30...v4.12.31
v4.12.30Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.12.29...v4.12.30
v4.12.29Compare Source
What's Changed
compatibilityDateby @yusukebe in #5100*as a match by @yusukebe in #5084New Contributors
Full Changelog: https://github.com/honojs/hono/compare/v4.12.28...v4.12.29
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.