Hono 4.13.5

Hono 4.13.5 is a security release published August 26, 2026, fixing three advisories that touch the query parser, static site generation, and form body parsing. The Hono team is strongly recommending an upgrade, especially for applications running behind a proxy, WAF, or logging layer that inspects query strings, or those using static site generation.

Security Fixes

Query Parser Reads Parameters After the URL Fragment

The first advisory (GHSA-crvj-82cr-hjcx) affects Cache Middleware and apps behind a proxy, WAF, or logging layer that inspects query strings. Query parsing did not stop at the URL fragment, so a ? appearing after a # was treated as the start of a query string. This let an application read parameters that the other component (proxy, cache, WAF) never saw, opening a cache-key and proxy interpretation differential.

toSSG() Path Containment Bypass

The second advisory (GHSA-gqvv-2mrq-wpjv) is an incomplete fix for CVE-2026-39408. The toSSG() helper for Static Site Generation could still write files outside the output directory. A gap in path normalization left consecutive parent-directory segments in ssgParams values uncollapsed, bypassing the containment check introduced in 4.12.12.

parseBody() Memory Exhaustion

The third advisory (GHSA-g6gw-c38x-mqfc) involves the parseBody() helper when dot-notation parsing is enabled. Unbounded dot-notation nesting meant a small request body could allocate a disproportionately large object graph, and concurrent requests could exhaust the heap.

Who Should Upgrade

Upgrade immediately if you use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or call parseBody({ dot: true }). The release is a drop-in patch; no API changes accompany the security fixes. Install it via your package manager with a note that Hono 4.13.5 should be treated as a priority update for any production deployment.