Hono Release Notes

What's Changed

• fix(serve-static): treat empty string content as found by @yusukebe in https://github.com/honojs/hono/pull/5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in https://github.com/honojs/hono/pull/5047
• chore: don't publish *.tsbuildinfo by @yusukebe in https://github.com/honojs/hono/pull/5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in https://github.com/honojs/hono/pull/5067
• fix: avoid circular dependency between body.ts and request.ts by @usualoma in https://github.com/honojs/hono/pull/5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in https://github.com/honojs/hono/pull/5059
• chore: bump devDependencies by @yusukebe in https://github.com/honojs/hono/pull/5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in https://github.com/honojs/hono/pull/5033
• docs(context-storage): fix JSDoc by @yusukebe in https://github.com/honojs/hono/pull/5086

New Contributors

• @EduardF1 made their first contribution in https://github.com/honojs/hono/pull/5047
• @greymoth-jp made their first contribution in https://github.com/honojs/hono/pull/5059
• @VihaanAgarwal made their first contribution in https://github.com/honojs/hono/pull/5033

Full Changelog: https://github.com/honojs/hono/compare/v4.12.27...v4.12.28

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in https://github.com/honojs/hono/pull/5013
• ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in https://github.com/honojs/hono/pull/5028
• chore: remove unused devcontainer and gitpod configs by @yusukebe in https://github.com/honojs/hono/pull/5029
• chore: replace arg and glob with Bun native APIs in build script by @yusukebe in https://github.com/honojs/hono/pull/5030

Full Changelog: https://github.com/honojs/hono/compare/v4.12.25...v4.12.26

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice …

What's Changed

• docs(contribution): simplifyAI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4972
• chore: remove @types/glob by @rtritto in https://github.com/honojs/hono/pull/4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in https://github.com/honojs/hono/pull/4987
• refactor(language): Test/improve tests on languages middleware by @iNeoO in https://github.com/honojs/hono/pull/4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in https://github.com/honojs/hono/pull/4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @Mohammad-Faiz-Cloud-Engineer in https://github.com/honojs/hono/pull/4982
• refactor(timing): Test/add test for middleware timing by @iNeoO in https://github.com/honojs/hono/pull/4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @sarathfrancis90 in https://github.com/honojs/hono/pull/4998

Full Changelog: https://github.com/honojs/hono/compare/v4.12.23...v4.12.24

What's Changed

• fix(serve-static): normalize all backslashes in file paths, not just the first in https://github.com/honojs/hono/pull/4962
• feat(context): export the Context class publicly by @BlankParticle in https://github.com/honojs/hono/pull/4543
• docs(contribution): add AI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4970
• feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in https://github.com/honojs/hono/pull/4961
• fix(utils/ipaddr): do not compress a single 0 group to :: by @yusukebe in https://github.com/honojs/hono/pull/4971

Full Changelog: https://github.com/honojs/hono/compare/v4.12.22...v4.12.23

What's Changed

• chore: update vitest to v4 and cleanups by @BlankParticle in https://github.com/honojs/hono/pull/4952
• fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in https://github.com/honojs/hono/pull/4912
• fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in https://github.com/honojs/hono/pull/4951
• fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in https://github.com/honojs/hono/pull/4955
• feat: add msgpack as a compressible content type by @na-trium-144 in https://github.com/honojs/hono/pull/4957

New Contributors

• @renatograsso10 made their first contribution in https://github.com/honojs/hono/pull/4912
• @LeSingh1 made their first contribution in https://github.com/honojs/hono/pull/4951
• @ATOM00blue made their first contribution in https://github.com/honojs/hono/pull/4955
• @na-trium-144 made their first contribution in https://github.com/honojs/hono/pull/4957

Full Changelog: https://github.com/honojs/hono/compare/v4.12.21...v4.12.22

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer …