Packages

hono

4.13.13MIT
  • 4.13.13 is the latest, published 4 October 2026.
  • 52 security advisories, all fixed.
  • 4.x: 195 releases since 9 February 2024, 17 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

21 older fixes

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

  1. 4.13.13

    4 October 2026
    App.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

    Mount Middleware

    app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

    import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

    app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

    - app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

    What's Changed

    • jsx: allow JSXNode function component results

    • deprecated

      mount: introduce Mount Middleware and deprecate app.mount

  2. 4.13.12

    30 September 2026
    Keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements

    What's Changed

    • build: keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements

    • etag: correctly match mixed-case header name in retainedHeader option

    • jsx: add px to numeric gridGap, gridRowGap and gridColumnGap

    • combine: return a Response from a short-circuiting middleware in some()

  3. 4.13.11

    29 September 2026
    Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

    Security fixes

    serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

    Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

    serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

    The same fix ships in @hono/node-server v2.1.3.

  4. 4.13.10

    28 September 2026
    The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

    Adapters are now separate packages

    The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

    hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

    - import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

    hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

    What's Changed

    • types: allow returning a Blob as a response body

    • adapters: add @hono/bun as a workspace package

    • adapters: add the seven adapters as workspace packages

    • adapters/deno: publish to JSR

  5. 4.13.9

    24 September 2026
    jsx: replace Suspense and ErrorBoundary content across newlines

    What's Changed

    • jsx: replace Suspense and ErrorBoundary content across newlines

    • accepts: match media types and language tags case-insensitively

    • linear-router: don't match an empty path segment as a param

    • pretty-json: don't break responses with unparseable JSON bodies

    • jwt: throw JwtTokenInvalid when the signature is not valid base64url

    • aws-lambda: treat binary +xml archive media types as binary

    • aws-lambda: preserve empty query parameters

    • lambda-edge: sync content type detection with aws-lambda

    • lambda-edge: fail with a descriptive error on a malformed event

  6. 4.13.8

    15 September 2026
    jsx/dom: reduce lookup work for large keyed updates

    What's Changed

    • jsx/dom: reduce lookup work for large keyed updates

    • aws-lambda: respect backpressure when streaming the response body

    • accepts, language: skip accept entries with quality 0 when matching

    • accept: treat the q parameter name as case-insensitive

    • accept: clamp a negative q to 0, not 1

    • request: keep the request media type when reusing a cached body

    • jsx/dom: optimize matching-head child lookup during reconciliation

  7. 4.13.7

    4 September 2026
    This release includes a fix for the following security issue:

    Security fixes

    This release includes a fix for the following security issue:

    hono/jsx renders plain strings unescaped in boundary components, leading to XSS

    Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

    Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

  8. 4.13.6

    4 September 2026
    client: keep a param value of "index" in $url() and $path()

    What's Changed

    • client: keep a param value of "index" in $url() and $path()

    • client: normalize root WebSocket URLs

    • types: allow symbol keys in Context<any> get and set fallbacks

  9. 4.13.5

    26 August 2026
    This release includes fixes for the following security issues:

    Security fixes

    This release includes fixes for the following security issues:

    Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

    Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

    Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

    Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

    Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

    Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

  10. 4.13.4

    24 August 2026
    request: handle params on unmatched requests

    What's Changed

    • request: handle params on unmatched requests

    • jsx/dom: execute previous ref cleanup when ref prop changes on re-render

    • reg-exp-router: associate wildcard middleware with matching routes

    • router: share null object creation

    • etag: match If-None-Match tags with optional whitespace before the comma

    • client: skip undefined header and cookie values

    • client: skip an undefined entry inside a query array

    • client: skip an undefined entry inside a form array

    • client: support custom buildSearchParams and filter undefined query in $ws() bin #5256

    • accepts: support wildcard media types and specificity ordering in defaultMatch

    • client: omit empty query delimiter

    • request: drop stale content length for cloned FormData

    • request: serialize cached JSON body in cloneRawRequest

    • cookie: allow parsing signed cookies with empty string values

    • utils/stream: do not let abort listeners crash abort()

Show 7 earlier releases

  1. 4.13.3

    18 August 2026
    client: prevent URL corruption when replaceUrlParam contains $ replacement tokens

    What's Changed

    • client: prevent URL corruption when replaceUrlParam contains $ replacement tokens

    • etag: copy pending stream bytes

    • etag: avoid skipping headers when filtering 304 response headers

    • cors: append Origin to Vary header on OPTIONS preflight

    • trie-router: match suffix wildcard routes

    • pattern-router/linear-router: prevent prefix overmatch on wildcard routes

    • csrf: exempt OPTIONS request from CSRF validation

    • utils/ipaddr: avoid truncation on embedded IPv4 addresses in expand IPv6

    • pretty-json: support structured JSON content-types (+json)

  2. 4.13.2

    13 August 2026
    secure-headers: output standard empty parentheses () instead of none for disabled Permissions-Policy directives

    What's Changed

    • secure-headers: output standard empty parentheses () instead of none for disabled Permissions-Policy directives

    • jsx: render async children of document metadata tags instead of [object Promise]

    • etag: resolve incorrect incremental hashing for chunked responses

    • client: serialize multiple cookies correctly

    • etag: stabilize digest across stream chunks

    • url: strip trailing question mark correctly for optional params with regex quantifiers

    • cors: pre-join static array header options during initialization

    • client: send falsy JSON bodies

    • secure-headers: add missing W3C Permissions-Policy directives

  3. 4.13.1

    7 August 2026
    trie-router: count every slash a pattern consumes

    What's Changed

    • trie-router: count every slash a pattern consumes

    • utils/stream: re-acquire writer lock when pipe() throws

    • etag: skip unsafe methods or error responses on non-* case

  4. 4.13.0

    3 August 2026
    Hono v4.13.0 is now available!

    Hono v4.13.0 is now available!

    The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

    Performance improvements

    This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

    Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

    Benchmarkv4.12v4.13Speedup
    ping — GET /165.83 ns163.99 ns1.01x
    query — GET /id/1?name=bun674.40 ns616.99 ns1.09x
    json — GET /user528.99 ns422.44 ns1.25x
    body — POST /json1.16 µs1.00 µs1.15x

    The individual changes:

    • context: iterate the header record with for..in #5118

    • url: replace regex tests with indexOf #5121

    • context: skip Headers creation when there are no headers to merge #5122

    • urls: refactor tryDecodeURIComponent #5158

    • request: allocate #validatedData lazily #5175

    • request: probe the body cache without allocating #5176

    In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

    Thanks @kibertoad for the contributions!

    First-class QUERY method support

    The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

    const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

    Thanks @shellhaki!

    QUERY support across built-in middleware

    The built-in middleware has been updated to handle QUERY requests properly:

    Cache Middleware

    The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

    app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

    Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

    ETag Middleware

    The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

    CORS Middleware

    The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

    Thanks @usualoma and @Cherry!

  5. 4.12.34

    3 August 2026
    This release includes fixes for the following security issues:

    Security fixes

    This release includes fixes for the following security issues:

    memo() retains SSR output across requests, leading to cross-user data disclosure

    Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

    ReDoS in CORS middleware via Access-Control-Request-Headers

    Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

    Algorithmic complexity DoS in Language Middleware

    Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

    Proxy Helper does not remove response headers listed in the Connection header

    Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

    Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

  6. 4.12.33

    31 July 2026
    cookie: relax name validation when parsing Cookie header

    What's Changed

    • cookie: relax name validation when parsing Cookie header

    • jsx: handle useSyncExternalStore subscription and snapshot changes

  7. 4.12.32

    24 July 2026
    aws-lambda: add jwt and lambda authorizer types for API Gateway v2

    What's Changed

    • aws-lambda: add jwt and lambda authorizer types for API Gateway v2

    • sse: emit empty id field to reset Last-Event-ID

    • use Object.create(null) when parsing query, headers, and params

    • secure-headers: keep CSP callbacks scoped to their header

All 410 releases

Major versions

  • 4.xsince 9 February 2024 · latest 4.13.13 · 195 releases
  • 3.xsince 18 February 2023 · latest 3.12.12 · 92 releases
  • 2.xsince 16 July 2022 · latest 2.7.8 · 49 releases
  • 1.xsince 22 April 2022 · latest 1.6.4 · 29 releases
  • 0.xsince 14 December 2021 · latest 0.5.10 · 45 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr doesAll packages