[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.13.2 → 4.13.11

---

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363 / GHSA-crvj-82cr-hjcx

More information

Details

Summary

Hono's query parsing does not stop at the URL fragment: a ? appearing after a # is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.

Details

A fragment is never part of the query, and every standard URL consumer — browsers, new URL(), reverse proxies — ignores everything from the first # onward. Hono's routing followed that rule; its query helpers did not.

For one and the same request, this produces an interpretation differential:

• A component in front of the application that inspects the query string — filtering rules, parameter allow/deny lists, access logging — observes no parameters, while the application reads and acts on them.
• The cache middleware removed the fragment when building its cache key, so a response influenced by parameters carried inside the fragment could be stored under a key that did not reflect them and later returned to other users.

The same divergence reaches request validation and any middleware that reads query parameters.

This requires a request target containing a literal # to reach the application. Deployments on runtimes that normalise such a target — including Cloudflare Workers — are not affected, and neither are those behind an intermediary that strips the fragment.

Impact

An attacker can cause the application to act on parameters that components in front of it never observe.

This may lead to:

• filtering rules, allow/deny lists, and audit logging being blind to parameters the application still processes
• a cached response being stored under a key that does not reflect the parameters used to produce it, and served to other users
• stored cross-site scripting, where such a parameter is reflected into a cached HTML response without escaping

This issue affects applications that read query parameters and run on a runtime that passes a literal # through to the request URL.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx
• https://nvd.nist.gov/vuln/detail/CVE-2026-84363
• https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc
• https://github.com/honojs/hono/releases/tag/v4.13.5
• https://github.com/advisories/GHSA-crvj-82cr-hjcx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

CVE-2026-84365 / GHSA-gqvv-2mrq-wpjv

More information

Details

Summary

The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.

Details

Static site generation builds each output path from the route path and the values supplied through ssgParams, then verifies that the result stays inside the output directory. That check normalizes the path with the same routine that built it, and the routine did not fully collapse runs of consecutive parent-directory segments. A value carrying enough of them produces a path the check accepts, but the filesystem resolves outside the output directory.

The earlier fix handled a single parent-directory segment, so it blocks the sequence reported at the time while leaving longer runs unhandled. The check also treated output directories that differ only in how they are rooted as equivalent.

This arises when an application generates a static site from route parameter values it does not fully control — slugs coming from a CMS, an API, or user submissions.

Impact

A value reaching ssgParams from an untrusted source can cause build output to be written outside the intended output directory, carrying whatever content the route handler produced.

This may lead to:

• files being created or overwritten elsewhere in the build environment
• generated artifacts or deployment output being altered

This affects build-time static site generation only; request-time routing is not affected. Applications whose ssgParams values are entirely developer-controlled are not affected.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv
• https://nvd.nist.gov/vuln/detail/CVE-2026-84365
• https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221
• https://github.com/honojs/hono/releases/tag/v4.13.5
• https://github.com/advisories/GHSA-gqvv-2mrq-wpjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

CVE-2026-93981 / GHSA-hxh3-vqpv-xpqv

More information

Details

Summary

hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString() / renderToReadableStream() from hono/jsx/dom/server. Such a string is emitted as markup instead of text.

Details

These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases:

• Suspense: a string child, or a string fallback while a child suspends. With streaming, the fallback reaches the browser in the initial chunk.
• ErrorBoundary: a string child alongside an asynchronous sibling. The all-synchronous case was fixed in 4.11.7 (GHSA-9r54-q6cx-xmh5).
• Context.Provider: a single string child. Multiple children are escaped.
• hono/jsx/dom/server: a string, or an array containing strings, passed as the root.

A lone {children} forwarded by a wrapper component is enough to reach these paths. Strings wrapped in an element, values from raw() or the html helper, and client-side rendering with hono/jsx/dom are not affected.

Impact

An attacker who controls a string rendered in an affected position can inject arbitrary HTML into the server-rendered page, leading to cross-site scripting under the application's origin.

This issue affects applications that render untrusted strings directly in one of the positions above during server-side rendering.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv
• https://nvd.nist.gov/vuln/detail/CVE-2026-93981
• https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e
• https://github.com/honojs/hono/releases/tag/v4.13.7
• https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings
• https://github.com/advisories/GHSA-hxh3-vqpv-xpqv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

CVE-2026-111757 / GHSA-5r4p-p66f-jhc7

More information

Details

Summary

serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Details

Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by serveStatic. Applications that serve only public files are not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
• https://nvd.nist.gov/vuln/detail/CVE-2026-111757
• https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
• https://github.com/honojs/hono/releases/tag/v4.13.11
• https://github.com/advisories/GHSA-5r4p-p66f-jhc7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
• fix(accepts): match media types and language tags case-insensitively in #​5376
• fix(linear-router): don't match an empty path segment as a param in #​5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
• fix(aws-lambda): preserve empty query parameters in #​5292
• fix(lambda-edge): sync content type detection with aws-lambda in #​5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #​5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
• fix(aws-lambda): respect backpressure when streaming the response body in #​5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
• fix(accept): treat the q parameter name as case-insensitive in #​5349
• fix(accept): clamp a negative q to 0, not 1 in #​5357
• fix(request): keep the request media type when reusing a cached body in #​5366
• docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Compare Source

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

Compare Source

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in #​5297
• fix(client): normalize root WebSocket URLs in #​5291
• fix(types): allow symbol keys in Context get and set fallbacks in #​5300
• chore: bump editorconfig-checker in #​5336
• refactor(on-handler): use forEach for consistent handler iteration in #​5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Compare Source

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

Compare Source

What's Changed

• fix(request): handle params on unmatched requests in #​5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in #​5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in #​5266
• perf(router): share null object creation in #​5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in #​5222
• fix(client): skip undefined header and cookie values in #​5244
• fix(client): skip an undefined entry inside a query array in #​5272
• fix(client): skip an undefined entry inside a form array in #​5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin #​5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in #​5255
• fix(client): omit empty query delimiter in #​5283
• fix(request): drop stale content length for cloned FormData in #​5282
• fix(request): serialize cached JSON body in cloneRawRequest in #​5288
• fix(cookie): allow parsing signed cookies with empty string values in #​5246
• fix(utils/stream): do not let abort listeners crash abort() in #​5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[cursor]

PR Summary

Low Risk
Lockfile-only dependency pin with no app logic changes; main risk is routine patch-level behavior differences in a transitive HTTP framework.

Overview
Bumps the pinned hono version in package.json overrides from 4.13.2 to 4.13.11, with the matching package-lock.json entry updated. There are no source changes—this forces a newer Hono release for transitive consumers (e.g. @hono/node-server) to pick up security fixes in the 4.13.x line (query parsing after URL fragments, toSSG() path containment, hono/jsx escaping, and related advisories described in the Renovate notes).

^{Reviewed by Cursor Bugbot for commit 83dab5f. Bugbot is set up for automated code reviews on this repo. Configure here.}