Hono 4.12.34

OK so Hono 4.12.34 just dropped and it's not a fun one — it's a security release. Four CVEs-worth of fixes, and the TL;DR is: if you use Hono for SSR, CORS, language middleware, or proxying, go update. Like, right now. I'll wait. ☕️

The Scary One: memo() Leaking Other Users' HTML

First up is a doozy — memo() in hono/jsx was retaining SSR output across requests. If two requests had equal props, the cached render result got reused... even when the component was reading request-scoped stuff from ambient context. useContext(), useRequestContext(), getContext() — all of it. Which means one user could literally get served HTML that was rendered for another user's request. Account data. CSRF tokens. That whole nightmare. GHSA-f23p-vx2j-j53r.

If you're doing server-side rendering with Hono JSX and a single shared memo() component tree, this is the one that should make you move fast.

ReDoS in CORS — Yes, Really

Then there's a ReDoS in hono/cors. The regex that parses Access-Control-Request-Headers preflight headers has quadratic backtracking when allowHeaders isn't configured (which is the default, lol). One preflight request with a long whitespace run = seconds of CPU = stalled request processing. Classic. GHSA-8j4g-w8fx-2239.

The Language Middleware DoS

Also on the list: hono/language had quadratic string processing in language-tag normalization. A crafted tag with a million hyphen-separated subtags — coming in via query param, cookie, or Accept-Language — could eat CPU and block the event loop. GHSA-54fx-42gc-7vw4.

Proxy Helper Connection-Header Leak

And finally, hono/proxy was forwarding response headers that the origin's Connection header marked as connection-scoped. Per RFC 9110 Section 7.6.1, those are meant for the immediate peer only — but Hono was passing them through to clients. Internal metadata, connection-scoped headers, all exposed. GHSA-79qm-7rj5-m7r9.

Should You Upgrade?

Is water wet? If you use hono/jsx for SSR, hono/cors, hono/language, or hono/proxy, this isn't a "maybe next sprint" situation. It's a npm i hono@latest situation. Period. No new features, no API changes — just four very good reasons to bump your lockfile. Go do it rn 🔗