Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #5434
• chore: replace prettier with oxfmt in #5435
• chore(deps): upgrade vitest to 5.0.1 in #5437
• chore: let oxfmt sort imports instead of eslint in #5442
• chore: replace eslint with oxlint in #5443
• chore: introduce Vite+ in #5444
• fix(types): allow returning a Blob as a response body in #5446
• chore: convert build scripts into plugins in #5448
• chore: stop editorconfig-checker from checking Markdown indent size in #5455
• ci: remove empty step left in cr.yml by the pnpm migration in #5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #5459
• feat(adapters): add @hono/bun as a workspace package in #5447
• chore(adapters/bun): ship ESM only in #5462
• feat(adapters): add the seven adapters as workspace packages in #5463
• feat(adapters/deno): publish to JSR in #5465
• test: move adapter runtime tests into adapters/* in #5466

Full Changelog: v4.13.9...v4.13.10

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #5380
• fix(accepts): match media types and language tags case-insensitively in #5376
• fix(linear-router): don't match an empty path segment as a param in #5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #5424
• fix(aws-lambda): preserve empty query parameters in #5292
• fix(lambda-edge): sync content type detection with aws-lambda in #5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #5358

Full Changelog: v4.13.8...v4.13.9

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #5340
• fix(aws-lambda): respect backpressure when streaming the response body in #5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #5311
• fix(accept): treat the q parameter name as case-insensitive in #5349
• fix(accept): clamp a negative q to 0, not 1 in #5357
• fix(request): keep the request media type when reusing a cached body in #5366
• docs(combine): fix except() JSDoc param and add missing @returns in #5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #5329

Full Changelog: v4.13.7...v4.13.8

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in #5297
• fix(client): normalize root WebSocket URLs in #5291
• fix(types): allow symbol keys in Context get and set fallbacks in #5300
• chore: bump editorconfig-checker in #5336
• refactor(on-handler): use forEach for consistent handler iteration in #5326

Full Changelog: v4.13.5...v4.13.6

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

What's Changed

• fix(request): handle params on unmatched requests in #5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in #5266
• perf(router): share null object creation in #5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in #5222
• fix(client): skip undefined header and cookie values in #5244
• fix(client): skip an undefined entry inside a query array in #5272
• fix(client): skip an undefined entry inside a form array in #5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin #5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in #5255
• fix(client): omit empty query delimiter in #5283
• fix(request): drop stale content length for cloned FormData in #5282
• fix(request): serialize cached JSON body in cloneRawRequest in #5288
• fix(cookie): allow parsing signed cookies with empty string values in #5246
• fix(utils/stream): do not let abort listeners crash abort() in #5274

Full Changelog: v4.13.3...v4.13.4

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #5227
• fix(etag): copy pending stream bytes in #5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #5235
• docs(context): add custom headers append option example to Context JSDoc in #5248
• fix(trie-router): match suffix wildcard routes in #5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #5247
• feat(pretty-json): support structured JSON content-types (+json) in #5226

Full Changelog: v4.13.2...v4.13.3

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #5199
• fix(client): serialize multiple cookies correctly in #5202
• fix(etag): stabilize digest across stream chunks in #5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #5209
• perf(cors): pre-join static array header options during initialization in #5210
• fix(client): send falsy JSON bodies in #5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #5214

Full Changelog: v4.13.1...v4.13.2

What's Changed

• fix(trie-router): count every slash a pattern consumes by @Jaybhade in #5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in #4988
• fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in #5196

New Contributors

• @Jaybhade made their first contribution in #5189
• @Sriharsha-dev369 made their first contribution in #4988

Full Changelog: v4.13.0...v4.13.1

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

The individual changes:

• perf(context): iterate the header record with for..in #5118
• perf(url): replace regex tests with indexOf #5121
• perf(context): skip Headers creation when there are no headers to merge #5122
• perf(urls): refactor tryDecodeURIComponent #5158
• perf(request): allocate #validatedData lazily #5175
• perf(request): probe the body cache without allocating #5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @usualoma and @Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @usualoma!

Other improvements

• hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @akahoshi1421!
• The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @arhxam!
• JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @ashunar0!
• JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @natsuki-engr!
• The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @yusukebe in #5113
• perf(context): iterate the header record with for..in by @yusukebe in #5118
• perf(url/request): replace regex tests with indexOf by @yusukebe in #5121
• perf(context): skip Headers creation when there are no headers to merge by @yusukebe in #5122
• perf(urls): refactor tryDecodeURIComponent by @yusukebe in #5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @kibertoad in #5173
• perf(context): drop the throwaway env field initializer by @kibertoad in #5174
• perf(request): allocate #validatedData lazily by @kibertoad in #5175
• perf(request): probe the body cache without allocating by @kibertoad in #5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @yusukebe in #5183
• perf(hono-base): restore the rest parameter in fetch by @yusukebe in #5184
• perf(context): restore the env field initializer by @yusukebe in #5186
• feat: add first-class QUERY method support by @shellhaki in #5070
• feat(etag): support conditional requests for the QUERY method by @Cherry in #5111
• feat(cors): allow QUERY by default as a first-class method by @usualoma in #5115
• feat(cache): add first-class support for QUERY requests by @usualoma in #5119
• feat(jsx): add React-compatible overloads to useRef by @ashunar0 in #5063
• feat(middleware): add method-not-allowed middleware by @usualoma in #5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @arhxam in #5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @akahoshi1421 in #5153
• fix(jsx): allow a function component to return an array by @natsuki-engr in #5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @usualoma in #5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @arhxam in #5137

Full Changelog: v4.12.34...v4.13.0

Thank you to all contributors!

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #5164
• chore: bump @hono/node-server in #5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #5166
• chore: remove undici in favor of global fetch in #5168

Full Changelog: v4.12.32...v4.12.33

What's Changed

• ci: enable reports for type & bundle size check in #5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #5142
• fix(sse): emit empty id field to reset Last-Event-ID in #5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #5145
• fix: use Object.create(null) when parsing query, headers, and params in #5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #5147

Full Changelog: v4.12.31...v4.12.32

What's Changed

• test(context): assert case-insensitive header names in response helpers by @yusukebe in #5116
• chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in #5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in #5130
• fix(utils/body): reuse cached formData in parseBody() by @yusukebe in #5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in #5133
• fix(sse): emit retry feild when retry is 0 by @yusukebe in #5135
• test(validator): fix misspelled identifier in transform type test by @yusukebe in #5136

Full Changelog: v4.12.30...v4.12.31

What's Changed

• chore(benchmark/routers): bump deps in #5107
• chore(benchmark): remove not used benchmarks in #5108
• chore: update to ts6 in prep for ts7 in #5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #5025
• fix(compress): do not compress 206 Partial Content responses in #5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #5110

Full Changelog: v4.12.29...v4.12.30

What's Changed

• fix(client): merge function headers with per-request headers by @yusukebe in #5092
• chore: fix no-op tsc in test script by @yusukebe in #5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in #5094
• docs(language): add JSDoc @example to languageDetector by @codebybilal18 in #5081
• test(workerd): add compatibilityDate by @yusukebe in #5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in #5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in #5101
• fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in #5103
• fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in #5102
• fix(etag): treat If-None-Match: * as a match by @yusukebe in #5084

New Contributors

• @codebybilal18 made their first contribution in #5081
• @Arman-Luthra made their first contribution in #5103

Full Changelog: v4.12.28...v4.12.29

What's Changed

• fix(serve-static): treat empty string content as found by @yusukebe in https://github.com/honojs/hono/pull/5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in https://github.com/honojs/hono/pull/5047
• chore: don't publish *.tsbuildinfo by @yusukebe in https://github.com/honojs/hono/pull/5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in https://github.com/honojs/hono/pull/5067
• fix: avoid circular dependency between body.ts and request.ts by @usualoma in https://github.com/honojs/hono/pull/5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in https://github.com/honojs/hono/pull/5059
• chore: bump devDependencies by @yusukebe in https://github.com/honojs/hono/pull/5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in https://github.com/honojs/hono/pull/5033
• docs(context-storage): fix JSDoc by @yusukebe in https://github.com/honojs/hono/pull/5086

New Contributors

• @EduardF1 made their first contribution in https://github.com/honojs/hono/pull/5047
• @greymoth-jp made their first contribution in https://github.com/honojs/hono/pull/5059
• @VihaanAgarwal made their first contribution in https://github.com/honojs/hono/pull/5033

Full Changelog: https://github.com/honojs/hono/compare/v4.12.27...v4.12.28

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in https://github.com/honojs/hono/pull/5013
• ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in https://github.com/honojs/hono/pull/5028
• chore: remove unused devcontainer and gitpod configs by @yusukebe in https://github.com/honojs/hono/pull/5029
• chore: replace arg and glob with Bun native APIs in build script by @yusukebe in https://github.com/honojs/hono/pull/5030

Full Changelog: https://github.com/honojs/hono/compare/v4.12.25...v4.12.26

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

What's Changed

• docs(contribution): simplifyAI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4972
• chore: remove @types/glob by @rtritto in https://github.com/honojs/hono/pull/4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in https://github.com/honojs/hono/pull/4987
• refactor(language): Test/improve tests on languages middleware by @iNeoO in https://github.com/honojs/hono/pull/4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in https://github.com/honojs/hono/pull/4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @Mohammad-Faiz-Cloud-Engineer in https://github.com/honojs/hono/pull/4982
• refactor(timing): Test/add test for middleware timing by @iNeoO in https://github.com/honojs/hono/pull/4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @sarathfrancis90 in https://github.com/honojs/hono/pull/4998

Full Changelog: https://github.com/honojs/hono/compare/v4.12.23...v4.12.24

What's Changed

• fix(serve-static): normalize all backslashes in file paths, not just the first in https://github.com/honojs/hono/pull/4962
• feat(context): export the Context class publicly by @BlankParticle in https://github.com/honojs/hono/pull/4543
• docs(contribution): add AI Usage Policy by @yusukebe in https://github.com/honojs/hono/pull/4970
• feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in https://github.com/honojs/hono/pull/4961
• fix(utils/ipaddr): do not compress a single 0 group to :: by @yusukebe in https://github.com/honojs/hono/pull/4971

Full Changelog: https://github.com/honojs/hono/compare/v4.12.22...v4.12.23

What's Changed

• chore: update vitest to v4 and cleanups by @BlankParticle in https://github.com/honojs/hono/pull/4952
• fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in https://github.com/honojs/hono/pull/4912
• fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in https://github.com/honojs/hono/pull/4951
• fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in https://github.com/honojs/hono/pull/4955
• feat: add msgpack as a compressible content type by @na-trium-144 in https://github.com/honojs/hono/pull/4957

New Contributors

• @renatograsso10 made their first contribution in https://github.com/honojs/hono/pull/4912
• @LeSingh1 made their first contribution in https://github.com/honojs/hono/pull/4951
• @ATOM00blue made their first contribution in https://github.com/honojs/hono/pull/4955
• @na-trium-144 made their first contribution in https://github.com/honojs/hono/pull/4957

Full Changelog: https://github.com/honojs/hono/compare/v4.12.21...v4.12.22

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

What's Changed

• fix(route): preserve the base path of the mounted route() app by @usualoma in https://github.com/honojs/hono/pull/4942
• fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in https://github.com/honojs/hono/pull/4947

New Contributors

• @ashunar0 made their first contribution in https://github.com/honojs/hono/pull/4947

Full Changelog: https://github.com/honojs/hono/compare/v4.12.19...v4.12.20

What's Changed

• ci: pin GitHub Actions to SHAs by @yusukebe in https://github.com/honojs/hono/pull/4932
• fix(serveStatic): make options parameter optional in all adapters by @mixelburg in https://github.com/honojs/hono/pull/4934
• fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in https://github.com/honojs/hono/pull/4922
• feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in https://github.com/honojs/hono/pull/4913
• feat(cache): key cache entries by configured vary headers by @usualoma in https://github.com/honojs/hono/pull/4915
• feat(request): add bytes() by @yusukebe in https://github.com/honojs/hono/pull/4921
• fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @yusukebe in https://github.com/honojs/hono/pull/4940

New Contributors

• @justinnais made their first contribution in https://github.com/honojs/hono/pull/4913

Full Changelog: https://github.com/honojs/hono/compare/v4.12.18...v4.12.19

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

What's Changed

• fix(jsx): normalize SVG attributes on the <svg> root element by @kfly8 in https://github.com/honojs/hono/pull/4893
• fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @yuintei in https://github.com/honojs/hono/pull/4899
• fix(cors): make origin optional in CORSOptions by @truffle-dev in https://github.com/honojs/hono/pull/4905
• fix(types): propagate middleware response types to app.on overloads by @T4ko0522 in https://github.com/honojs/hono/pull/4906

New Contributors

• @kfly8 made their first contribution in https://github.com/honojs/hono/pull/4893
• @truffle-dev made their first contribution in https://github.com/honojs/hono/pull/4905

Full Changelog: https://github.com/honojs/hono/compare/v4.12.16...v4.12.17

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

What's Changed

• fix(jwt): support single-line PEM keys by @hiendv in https://github.com/honojs/hono/pull/4889

New Contributors

• @hiendv made their first contribution in https://github.com/honojs/hono/pull/4889

Full Changelog: https://github.com/honojs/hono/compare/v4.12.14...v4.12.15

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

• fix(aws-lambda): handle invalid header names in request processing (#4883) fa2c74fe

What's Changed

• fix(types): infer response type from last handler in app.on 9-/10-handler overloads by @T4ko0522 in https://github.com/honojs/hono/pull/4865
• feat(trailing-slash): add skip option by @yusukebe in https://github.com/honojs/hono/pull/4862
• feat(cache): add onCacheNotAvailable option by @yusukebe in https://github.com/honojs/hono/pull/4876

New Contributors

• @T4ko0522 made their first contribution in https://github.com/honojs/hono/pull/4865

Full Changelog: https://github.com/honojs/hono/compare/v4.12.12...v4.12.13

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

Users who use Serve Static, Static Site Generation, Cookie utilities, or IP restriction middleware are strongly encouraged to upgrade to this version.

What's Changed

• feat(css): add classNameSlug option to createCssContext by @flow-pie in https://github.com/honojs/hono/pull/4834

New Contributors

• @flow-pie made their first contribution in https://github.com/honojs/hono/pull/4834

Full Changelog: https://github.com/honojs/hono/compare/v4.12.10...v4.12.11

What's Changed

• test(router): fix Simple capturing group test by @yusukebe in https://github.com/honojs/hono/pull/4838
• docs: fix impaired -> inspired typo in benchmark READMEs by @Abhi3975 in https://github.com/honojs/hono/pull/4843
• fix(jsx/dom): apply select value after children are rendered by @usualoma in https://github.com/honojs/hono/pull/4847
• fix(compress): convert strong ETag to weak ETag when compressing by @usualoma in https://github.com/honojs/hono/pull/4848
• docs(ip-restriction): add clear JSDoc examples and param types by @VISHNU7KASIREDDY in https://github.com/honojs/hono/pull/4851

New Contributors

• @Abhi3975 made their first contribution in https://github.com/honojs/hono/pull/4843
• @VISHNU7KASIREDDY made their first contribution in https://github.com/honojs/hono/pull/4851

Full Changelog: https://github.com/honojs/hono/compare/v4.12.9...v4.12.10

What's Changed

• fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in https://github.com/honojs/hono/pull/4807
• feat(client): add PickResponseByStatusCode type by @yusukebe in https://github.com/honojs/hono/pull/4791
• fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @yuintei in https://github.com/honojs/hono/pull/4810
• fix(service-worker): make fire() fallback behavior consistent with handle() by @yusukebe in https://github.com/honojs/hono/pull/4821
• fix(cors): reflect request origin when credentials is true with wildcard by @ctonneslan in https://github.com/honojs/hono/pull/4813

New Contributors

• @yuintei made their first contribution in https://github.com/honojs/hono/pull/4810
• @ctonneslan made their first contribution in https://github.com/honojs/hono/pull/4813

Full Changelog: https://github.com/honojs/hono/compare/v4.12.8...v4.12.9

What's Changed

• fix(utils/mime): Normalize input extension to lowercase before MIME check by @TheEssem in https://github.com/honojs/hono/pull/4800
• fix(bearer-auth): escape regex metacharacters in bearer auth prefix option by @otoneko1102 in https://github.com/honojs/hono/pull/4750

New Contributors

• @TheEssem made their first contribution in https://github.com/honojs/hono/pull/4800

Full Changelog: https://github.com/honojs/hono/compare/v4.12.7...v4.12.8

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: https://github.com/honojs/hono/compare/v4.12.6...v4.12.7

What's Changed

• fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in https://github.com/honojs/hono/pull/4758
• fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in https://github.com/honojs/hono/pull/4792
• chore(builld): tsconfig project references by @BarryThePenguin in https://github.com/honojs/hono/pull/4797
• chore: add tsconfig.spec.json by @yusukebe in https://github.com/honojs/hono/pull/4798
• feat(jsx-renderer): support function-based options by @3w36zj6 in https://github.com/honojs/hono/pull/4780
• fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in https://github.com/honojs/hono/pull/4782

New Contributors

• @t0waxx made their first contribution in https://github.com/honojs/hono/pull/4782

Full Changelog: https://github.com/honojs/hono/compare/v4.12.5...v4.12.6

What's Changed

• fix(request): return string | undefined from param() when path type is any by @andrewdamelio in https://github.com/honojs/hono/pull/4723
• fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in https://github.com/honojs/hono/pull/4752
• fix(jsx): Fix "Invalid state: Controller is already closed" by @gaearon in https://github.com/honojs/hono/pull/4770
• chore(eslint): upgrade @hono/eslint-config by @BarryThePenguin in https://github.com/honojs/hono/pull/4781

New Contributors

• @andrewdamelio made their first contribution in https://github.com/honojs/hono/pull/4723
• @otoneko1102 made their first contribution in https://github.com/honojs/hono/pull/4752
• @gaearon made their first contribution in https://github.com/honojs/hono/pull/4770

Full Changelog: https://github.com/honojs/hono/compare/v4.12.4...v4.12.5

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w

Middleware Bypass in Serve Static

Affects: Serve Static middleware. Fixes inconsistent URL decoding that could allow protected static resources to be accessed without triggering route-based middleware. https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr

Users who uses Strreaming Helper, Cookie utility, and Serve Static are strongly encouraged to upgrade to this version.

Other changes

• fix(client): preserve route schema in ApplyGlobalResponse by @agumy in https://github.com/honojs/hono/pull/4777
• fix(utils/url): specify the return type of tryDecodeURI by @yusukebe in https://github.com/honojs/hono/pull/4779

New Contributors

• @agumy made their first contribution in https://github.com/honojs/hono/pull/4777

Full Changelog: https://github.com/honojs/hono/compare/v4.12.3...v4.12.4

What's Changed

• fix(validator): prevent type diff bug in form data parsing by @EdamAme-x in https://github.com/honojs/hono/pull/4753
• fix(jwt): use Math.floor instead of bitwise OR for safe timestamp by @EdamAme-x in https://github.com/honojs/hono/pull/4754
• fix(jwt): fix JwtVariables for ContextVariableMap by @yusukebe in https://github.com/honojs/hono/pull/4764
• fix(types): remove DOM type dependencies from ClientResponse and request method by @YevheniiKotyrlo in https://github.com/honojs/hono/pull/4768
• fix(types): correct middleware types by @hmnd in https://github.com/honojs/hono/pull/4774
• fix(jwt): prevent memory leak by avoiding mutation of options object by @EdamAme-x in https://github.com/honojs/hono/pull/4759

New Contributors

• @YevheniiKotyrlo made their first contribution in https://github.com/honojs/hono/pull/4768
• @hmnd made their first contribution in https://github.com/honojs/hono/pull/4774

Full Changelog: https://github.com/honojs/hono/compare/v4.12.2...v4.12.3

Security fix

Fixed incorrect handling of X-Forwarded-For in the AWS Lambda adapter behind ALB that could allow IP-based access control bypass. The detail: https://github.com/honojs/hono/security/advisories/GHSA-xh87-mx6m-69f3

Thanks @EdamAme-x

What's Changed

• fix(context): revert PR #4707 by @yusukebe in https://github.com/honojs/hono/pull/4757

Full Changelog: https://github.com/honojs/hono/compare/v4.12.1...v4.12.2

What's Changed

• fix(client): export ApplyGlobalResponse from hono/client by @sushichan044 in https://github.com/honojs/hono/pull/4743

Full Changelog: https://github.com/honojs/hono/compare/v4.12.0...v4.12.1

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')

// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'

// With path parameters
const postPath = client.api.posts[':id'].$path({
  param: { id: '123' },
})
// => '/api/posts/123'

// With query parameters
const searchPath = client.api.posts.$path({
  query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))

type AppWithErrors = ApplyGlobalResponse<
  typeof app,
  {
    401: { json: { error: string; message: string } }
    500: { json: { error: string; message: string } }
  }
>

const client = hc<AppWithErrors>('http://api.example.com')
// Now client knows about both success and error responses
const res = await client.api.users.$get()
// InferResponseType includes { users: string[] } | { error: string; message: string }

Thanks @mohankumarelec!

SSG Redirect Plugin

A new redirectPlugin for SSG generates static HTML redirect pages for HTTP redirect responses (301, 302, 303, 307, 308):

import { toSSG } from 'hono/ssg'
import { defaultPlugin, redirectPlugin } from 'hono/ssg'

const app = new Hono()
app.get('/old', (c) => c.redirect('/new'))
app.get('/new', (c) => c.html('New Page'))

// redirectPlugin must be placed before defaultPlugin
await toSSG(app, fs, {
  plugins: [redirectPlugin(), defaultPlugin()],
})

The generated redirect pages include a <meta http-equiv="refresh"> tag, a canonical link, and a robots noindex meta tag.

Thanks @3w36zj6!

onAuthSuccess Callback for Basic Auth

The Basic Auth middleware now supports an onAuthSuccess callback that is invoked after successful authentication. This allows you to set context variables or perform logging without re-parsing the Authorization header:

app.use(
  '/auth/*',
  basicAuth({
    username: 'hono',
    password: 'ahotproject',
    onAuthSuccess: (c, username) => {
      c.set('user', { name: username, role: 'admin' })
      console.log(`User ${username} authenticated`)
    },
  })
)

The callback also works with async functions and the verifyUser mode.

Thanks @AprilNEA!

getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify

getConnInfo() is now available for three additional adapters:

// AWS Lambda (supports API Gateway v1, v2, and ALB)
import { handle, getConnInfo } from 'hono/aws-lambda'

// Cloudflare Pages
import { handle, getConnInfo } from 'hono/cloudflare-pages'

// Netlify
import { handle, getConnInfo } from 'hono/netlify'

app.get('/', (c) => {
  const info = getConnInfo(c)
  return c.text(`Your IP: ${info.remote.address}`)
})

Thanks @rokasta12!

alwaysRedirect Option for Trailing Slash Middleware

The trailing slash middleware now supports an alwaysRedirect option. When enabled, the middleware redirects before executing handlers, which fixes the issue where trailing slash handling doesn't work with wildcard routes:

app.use(trimTrailingSlash({ alwaysRedirect: true }))

app.get('/my-path/*', async (c) => {
  return c.text('wildcard')
})

// /my-path/something/ will be redirected to /my-path/something
// before the wildcard handler is executed

Progressive Locale Code Truncation

The normalizeLanguage function in the language middleware now supports RFC 4647 Lookup-based progressive truncation. Locale codes like ja-JP will match ja when only the base language is in supportedLanguages:

app.use(
  '/*',
  languageDetector({
    supportedLanguages: ['en', 'ja'],
    fallbackLanguage: 'en',
    order: ['cookie', 'header'],
  })
)

// Accept-Language: ja-JP → matches 'ja'
// Accept-Language: ko-KR → falls back to 'en'

Thanks @sorafujitani!

exports Field for ExecutionContext

The ExecutionContext type now includes an exports property for Cloudflare Workers. You can use module augmentation to type it with Wrangler's generated types:

import 'hono'

declare module 'hono' {
  interface ExecutionContext {
    readonly exports: Cloudflare.Exports
  }
}

Thanks @toreis-up!

Performance Improvements

TrieRouter 1.5x ~ 2.0x Faster

The TrieRouter has been significantly optimized with reduced spread syntax usage, O(1) hasChildren checks, lazy regular expression generation, and removal of redundant processes:

Thanks @EdamAme-x!

Fast Path for c.json()

c.json() now has the same fast path optimization as c.text(). When no custom status, headers, or finalized state exists, the Response is created directly without allocating a Headers object:

// This common pattern is now faster
return c.json({ message: 'Hello' })

Benchmark results:

Thanks @mgcrea!

New features

• feat(client): Add ApplyGlobalResponse type helper for RPC Client https://github.com/honojs/hono/pull/4556
• feat(ssg): add redirect plugin https://github.com/honojs/hono/pull/4599
• feat(client): $path https://github.com/honojs/hono/pull/4636
• feat(basic-auth): add context key and callback options https://github.com/honojs/hono/pull/4645
• feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify https://github.com/honojs/hono/pull/4649
• feat(trailing-slash): add alwaysRedirect option to support wildcard routes https://github.com/honojs/hono/pull/4658
• feat(language): add progressive locale code truncation to normalizeLanguage https://github.com/honojs/hono/pull/4717
• feat(types): Add exports field to ExecutionContext https://github.com/honojs/hono/pull/4719

Performance

• perf(context): add fast path to c.json() matching c.text() optimization https://github.com/honojs/hono/pull/4707
• perf(trie-router): improve performance (1.5x ~ 2.0x) https://github.com/honojs/hono/pull/4724
• perf(context): use createResponseInstance for new Response https://github.com/honojs/hono/pull/4733

All changes

• fix(jsx/dom): handle empty arrays in render children loop by @mixelburg in https://github.com/honojs/hono/pull/4729
• perf(jsx/dom): flatten children once at the start to avoid repeated flattening by @usualoma in https://github.com/honojs/hono/pull/4730
• fix(client): skip undefined values in form data serialization by @aidenlx in https://github.com/honojs/hono/pull/4732
• feat(client): Add ApplyGlobalResponse type helper for RPC Client by @mohankumarelec in https://github.com/honojs/hono/pull/4556
• feat(ssg): add redirect plugin by @3w36zj6 in https://github.com/honojs/hono/pull/4599
• feat(client): $path by @ShaMan123 in https://github.com/honojs/hono/pull/4636
• feat(basic-auth): add context key and callback options by @AprilNEA in https://github.com/honojs/hono/pull/4645
• feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify by @rokasta12 in https://github.com/honojs/hono/pull/4649
• feat(trailing-slash): add alwaysRedirect option to support wildcard routes by @yusukebe in https://github.com/honojs/hono/pull/4658
• perf(context): add fast path to c.json() matching c.text() optimization by @mgcrea in https://github.com/honojs/hono/pull/4707
• feat(language): add progressive locale code truncation to normalizeLanguage by @sorafujitani in https://github.com/honojs/hono/pull/4717
• feat(types): Add exports field to ExecutionContext by @toreis-up in https://github.com/honojs/hono/pull/4719
• perf(trie-router): improve performance (1.5x ~ 2.0x) by @EdamAme-x in https://github.com/honojs/hono/pull/4724
• perf(context): use createResponseInstance for new Response by @yusukebe in https://github.com/honojs/hono/pull/4733
• Next by @yusukebe in https://github.com/honojs/hono/pull/4735

New Contributors

• @mixelburg made their first contribution in https://github.com/honojs/hono/pull/4729
• @aidenlx made their first contribution in https://github.com/honojs/hono/pull/4732
• @mohankumarelec made their first contribution in https://github.com/honojs/hono/pull/4556
• @ShaMan123 made their first contribution in https://github.com/honojs/hono/pull/4636
• @rokasta12 made their first contribution in https://github.com/honojs/hono/pull/4649
• @mgcrea made their first contribution in https://github.com/honojs/hono/pull/4707

Full Changelog: https://github.com/honojs/hono/compare/v4.11.10...v4.12.0

What's Changed

• fix: fixed to be more properly timing safe (Merge commit from fork 91def7ca)

Full Changelog: https://github.com/honojs/hono/compare/v4.11.9...v4.11.10

What's Changed

• fix(url): ignore fragment identifiers in getPath() by @sano-suguru in https://github.com/honojs/hono/pull/4627
• fix: determine if rendered or not by node.vC[0] instead of referring to node.pP by @usualoma in https://github.com/honojs/hono/pull/4663

Full Changelog: https://github.com/honojs/hono/compare/v4.11.8...v4.11.9

What's Changed

• fix(jsx): preserve context when using await before html helper by @kaigritun in https://github.com/honojs/hono/pull/4662
• fix(bearer-auth): make auth-scheme case-insensitive by @bytaesu in https://github.com/honojs/hono/pull/4659

New Contributors

• @kaigritun made their first contribution in https://github.com/honojs/hono/pull/4662

Full Changelog: https://github.com/honojs/hono/compare/v4.11.7...v4.11.8

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

• Use IP Restriction Middleware
• Use Cache Middleware on Deno, Bun, or Node.js
• Use Serve Static Middleware with user-controlled paths on Cloudflare Workers
• Render untrusted data inside ErrorBoundary components

Security Advisories & CVEs

• IP Restriction Middleware – IPv4 address validation bypass

  • Advisory: https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh
  • CVE: CVE-2026-24398

• Cache Middleware ignores Cache-Control: private

  • Advisory: https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4
  • CVE: CVE-2026-24472

• Serve Static Middleware (Cloudflare Workers adapter) – Arbitrary key read

  • Advisory: https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p
  • CVE: CVE-2026-24473

• hono/jsx ErrorBoundary – Cross-Site Scripting (XSS)

  • Advisory: https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5
  • CVE: Pending

Full Changelog: https://github.com/honojs/hono/compare/v4.11.6...v4.11.7

What's Changed

• refactor: use unique symbol for more accurate typing. by @usualoma in https://github.com/honojs/hono/pull/4651
• docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant by @sano-suguru in https://github.com/honojs/hono/pull/4630
• fix(sse): handle \r and \r\n line endings in writeSSE by @AprilNEA in https://github.com/honojs/hono/pull/4644
• feat(bun): export getBunServer by @artemtam in https://github.com/honojs/hono/pull/4626

New Contributors

• @sano-suguru made their first contribution in https://github.com/honojs/hono/pull/4630
• @AprilNEA made their first contribution in https://github.com/honojs/hono/pull/4644
• @artemtam made their first contribution in https://github.com/honojs/hono/pull/4626

Full Changelog: https://github.com/honojs/hono/compare/v4.11.5...v4.11.6

What's Changed

• fix(client): exclude $all from ClientRequest type by @paveg in https://github.com/honojs/hono/pull/4611
• refactor(jwks): mark allowedAlgorithms, so the user can pass a `const… by @nikeee in https://github.com/honojs/hono/pull/4641
• feat(jwt): export AlgorithmTypes by @yusukebe in https://github.com/honojs/hono/pull/4642

New Contributors

• @paveg made their first contribution in https://github.com/honojs/hono/pull/4611
• @nikeee made their first contribution in https://github.com/honojs/hono/pull/4641

Full Changelog: https://github.com/honojs/hono/compare/v4.11.4...v4.11.5

Security

Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.

Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.

JWT middleware

import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256', // required
  })
)

JWK/JWKS middleware

import { jwk } from 'hono/jwk'

app.use(
  '/auth/*',
  jwk({
    jwks_uri: 'https://example.com/.well-known/jwks.json',
    alg: ['RS256'], // required (asymmetric algorithms only)
  })
)

For more details, see the Security Advisory.

• https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4
• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4

What's Changed

• test(utils/jwt): add missing algorithm types in jwa.test.ts by @flathill404 in https://github.com/honojs/hono/pull/4607
• chore: bump @hono/eslint-config and enable curly rule by @yusukebe in https://github.com/honojs/hono/pull/4620
• docs(bun/websocket): Fixed a typo in hono/bun deprecation message and updated test. by @Itsnotaka in https://github.com/honojs/hono/pull/4618
• test: support alg option for JWT middleware by @yusukebe in https://github.com/honojs/hono/pull/4624

New Contributors

• @flathill404 made their first contribution in https://github.com/honojs/hono/pull/4607
• @Itsnotaka made their first contribution in https://github.com/honojs/hono/pull/4618

Full Changelog: https://github.com/honojs/hono/compare/v4.11.3...v4.11.4

What's Changed

• fix(types): fix middleware union type merging in MergeMiddlewareResponse by @yusukebe in https://github.com/honojs/hono/pull/4602

Full Changelog: https://github.com/honojs/hono/compare/v4.11.2...v4.11.3

What's Changed

• docs: improve grammar in contributing documentation by @Ishiezz in https://github.com/honojs/hono/pull/4581
• fix(validator): preserve literal union types in input type inference by @yusukebe in https://github.com/honojs/hono/pull/4583
• chore: bump typescript-go preview for accurate benchmarking by @sushichan044 in https://github.com/honojs/hono/pull/4586
• refactor(hono-base): add type annotations by @yusukebe in https://github.com/honojs/hono/pull/4591
• refactor(client): refactor HonoURL types by @yusukebe in https://github.com/honojs/hono/pull/4592
• perf(types): reduce Simplify in ToSchema by @yusukebe in https://github.com/honojs/hono/pull/4597
• perf(types): optimize MergeMiddlewareResponse type by @yusukebe in https://github.com/honojs/hono/pull/4598

New Contributors

• @Ishiezz made their first contribution in https://github.com/honojs/hono/pull/4581

Full Changelog: https://github.com/honojs/hono/compare/v4.11.1...v4.11.2

What's Changed

• fix(types): fix app.on method array type inference by @kosei28 in https://github.com/honojs/hono/pull/4578

Full Changelog: https://github.com/honojs/hono/compare/v4.11.0...v4.11.1

Release Notes

Hono v4.11.0 is now available!

This release includes new features for the Hono client, middleware improvements, and an important type system fix.

Type System Fix for Middleware

We've fixed a bug in the type system for middleware. Previously, app did not have the correct type with pathless handlers:

const app = new Hono()
  .use(async (c, next) => {
    await next()
  })
  .get('/a', async (c, next) => {
    await next()
  })
  .get((c) => {
    return c.text('Hello')
  })

// app's type was incorrect

This has now been fixed.

Thanks @kosei28!

Typed URL for Hono Client

You can now pass the base URL as the second type parameter to hc to get more precise URL types:

const client = hc<typeof app, 'http://localhost:8787'>(
  'http://localhost:8787/'
)

const url = client.api.posts.$url()
// url is TypedURL with precise type information
// including protocol, host, and path

This is useful when you want to use the URL as a type-safe key for libraries like SWR.

Thanks @miyaji255!

Custom NotFoundResponse Type

You can now customize the NotFoundResponse type using module augmentation. This allows c.notFound() to return a typed response:

import { Hono, TypedResponse } from 'hono'

declare module 'hono' {
  interface NotFoundResponse
    extends Response,
      TypedResponse<{ error: string }, 404, 'json'> {}
}

const app = new Hono()
  .get('/posts/:id', async (c) => {
    const post = await getPost(c.req.param('id'))
    if (!post) {
      return c.notFound()
    }
    return c.json({ post }, 200)
  })
  .notFound((c) => c.json({ error: 'not found' }, 404))

Now the client can correctly infer the 404 response type.

Thanks @miyaji255!

tryGetContext Helper

The new tryGetContext() helper in the Context Storage middleware returns undefined instead of throwing an error when the context is not available:

import { tryGetContext } from 'hono/context-storage'

const context = tryGetContext<Env>()
if (context) {
  // Context is available
  console.log(context.var.message)
}

Thanks @AyushCoder9!

Custom Query Serializer

You can now customize how query parameters are serialized using the buildSearchParams option:

const client = hc<AppType>('http://localhost', {
  buildSearchParams: (query) => {
    const searchParams = new URLSearchParams()
    for (const [k, v] of Object.entries(query)) {
      if (v === undefined) continue
      if (Array.isArray(v)) {
        v.forEach((item) => searchParams.append(`${k}[]`, item))
      } else {
        searchParams.set(k, v)
      }
    }
    return searchParams
  },
})

Thanks @bolasblack!

New features

• feat(types): make Hono client's $url return the exact URL type https://github.com/honojs/hono/pull/4502
• feat(types): enhance NotFoundHandler to support custom NotFoundResponse type https://github.com/honojs/hono/pull/4518
• feat(timing): add wrapTime to simplify usage https://github.com/honojs/hono/pull/4519
• feat(pretty-json): support force option https://github.com/honojs/hono/pull/4531
• feat(client): add buildSearchParams option to customize query serialization https://github.com/honojs/hono/pull/4535
• feat(context-storage): add optional tryGetContext helper https://github.com/honojs/hono/pull/4539
• feat(secure-headers): add CSP report-to and report-uri directive support https://github.com/honojs/hono/pull/4555
• fix(types): replace schema-based path tracking with CurrentPath parameter https://github.com/honojs/hono/pull/4552

All changes

• chore: update esbuild to version 0.27.1 by @kosei28 in https://github.com/honojs/hono/pull/4571
• fix(hono/jsx): display blank when children is nullish by @techfish-11 in https://github.com/honojs/hono/pull/4573
• feat(types): make Hono client's $url return the exact URL type by @miyaji255 in https://github.com/honojs/hono/pull/4502
• feat(types): enhance NotFoundHandler to support custom NotFoundResponse type by @miyaji255 in https://github.com/honojs/hono/pull/4518
• feat(timing): add wrapTime to simplify usage by @PassiDel in https://github.com/honojs/hono/pull/4519
• feat(pretty-json): support force option by @missinglink in https://github.com/honojs/hono/pull/4531
• feat(context-storage): Add optional tryGetContext helper to context-storage middleware by @AyushCoder9 in https://github.com/honojs/hono/pull/4539
• feat(client): add buildSearchParams option to customize query serialization by @bolasblack in https://github.com/honojs/hono/pull/4535
• feat(secure-headers): Add CSP report-to and report-uri directive support by @cruzz77 in https://github.com/honojs/hono/pull/4555
• fix(types): replace schema-based path tracking with CurrentPath parameter by @kosei28 in https://github.com/honojs/hono/pull/4552
• Next by @yusukebe in https://github.com/honojs/hono/pull/4574

New Contributors

• @missinglink made their first contribution in https://github.com/honojs/hono/pull/4531
• @bolasblack made their first contribution in https://github.com/honojs/hono/pull/4535
• @cruzz77 made their first contribution in https://github.com/honojs/hono/pull/4555

Full Changelog: https://github.com/honojs/hono/compare/v4.10.8...v4.11.0