Repository navigation
fix(deps): update dependency hono to v4.13.16 [security] - #106
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.13.13→4.13.16Hono:
csshelper does not escape a closing tag split between the template and an interpolated value, allowing HTML injectionCVE-2026-126359 / GHSA-3gg2-335m-rxc6
More information
Details
Summary
The
csshelper inhono/cssescapes a/that follows<inside an interpolated value so that a value cannot close the<style>element. The check only looks inside each value. When the text before a value ends with<, whether that is the template itself or an earlier interpolated value, and the next value starts with/, the/is not escaped and the combined output contains an unescaped closing tag.Details
Interpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes
</therefore cannot see a<that belongs to the template. A template such as acontentdeclaration that opens with a literal<and interpolates a string right after it produces a raw</style>when that string starts with/style>. During server-side rendering the<Style />element is closed early and the rest of the value is interpreted as HTML.This issue arises only when
<is the last character before an interpolation in acsstemplate, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.Impact
A client that controls such a value can inject HTML, including script, into the page rendered on the server.
This may lead to:
This issue affects applications that interpolate untrusted strings into a
csstemplate immediately after a<, including two adjacent interpolations such as${prefix}${name}where both are untrusted. Other uses of thecsshelper are not affected.Workarounds
Do not interpolate untrusted values into
csstemplates, or make sure the text before an interpolated value does not end with<.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
CVE-2026-126358 / GHSA-h7mg-cq63-vhpq
More information
Details
Summary
RegExpRouter, which the default
SmartRouterselects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it:/api/:tenant{[^/]+}/admin/*, was not applied to a route written as/api/:tenant/admin/:id. (since 4.13.0)/admin/*was not applied to a route registered on/admin*for paths under/admin/. (since 4.1.4)%0A,%0D,%E2%80%A8,%E2%80%A9), no wildcard pattern matched, so the request reached the not-found handler without any wildcard middleware. (since 4.4.0)TrieRouter, LinearRouter and PatternRouter apply the middleware in all three cases.
Details
RegExpRouter decides at registration time which wildcard middleware covers which route. In cases 1 and 2 it treated patterns that match the same requests as different ones. In case 3 the compiled wildcard did not match line terminators.
The fix derives the coverage from the structure of the registered paths and lets wildcards match line terminators. It also corrects other differences from the other routers (a wildcard in the middle of a path with parameters, duplicate middleware, middleware on static routes), and rejects custom patterns that can match the empty string, such as
{[0-9]*}, withUnsupportedPathError.PreparedRegExpRouterdata must be regenerated.Impact
An unauthenticated client can reach a route handler, or the not-found handler, without the authentication or authorization middleware registered on a wildcard path.
This affects applications that use RegExpRouter, directly or through the default
SmartRouter, and rely on wildcard middleware for authentication or authorization.Workarounds
Use
new Hono({ router: new TrieRouter() }).Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono:
mount()andapp.mount()can forward a path that bypasses middleware scoped inside the mount prefixCVE-2026-126357 / GHSA-4m76-xfj5-7975
More information
Details
Summary
mount()andapp.mount()remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on/app/admin/*. The outer application routes on the original path, so the middleware does not run.Details
/api/:tenant/*, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so/api/a/xxxxx/admin/secretreaches the mounted application as/admin/secret.url.pathname, which turns a decoded backslash into/and collapses.../app/public%5C..%5Cadmin/secretreaches the mounted application as/admin/secret.The fix removes the prefix segment by segment from the raw pathname, using the matched parameter values for its length. Route patterns that cannot be handled safely now throw: duplicate parameter names and a wildcard inside the last segment such as
/assets*. A trailing slash in anapp.mount()prefix no longer removes an extra segment.Impact
An unauthenticated client can reach a route of a mounted application that the outer application protects with path-scoped middleware.
This affects applications that use
mount()orapp.mount()and rely on middleware registered on a sub-path inside the mount prefix for authentication or authorization.Workarounds
Register the authentication middleware inside the mounted application.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono:
validator('form')skips validation formultipart/form-datarequests with extra parametersCVE-2026-126356 / GHSA-4h7h-rv7c-7m2v
More information
Details
Summary
validator('form')only recognizes amultipart/form-dataContent-Typethat carries nothing but a singleboundaryparameter. A request with another legal parameter, such ascharset, or with extra whitespace after the;is not recognized as a form. The validation callback then receives an empty object, whilec.req.parseBody()still parses the body as a form.Details
The check that decides whether a request body is a form was written as a strict pattern over the whole
Content-Typevalue. Any parameter list that does not look exactly like; boundary=...fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can still read all submitted fields throughc.req.parseBody()orc.req.formData().application/x-www-form-urlencodedis not affected. Only themultipart/form-databranch has the strict pattern.This issue arises when an application relies on
validator('form')to reject or restrict fields and the validation callback does not fail on an empty object.Impact
An unauthenticated client can send form fields that the
formvalidator never sees, by adding a legal parameter to theContent-Typeheader.This may lead to:
This issue affects applications that use
validator('form')withmultipart/form-datarequests and whose validation callback accepts an empty object.Workarounds
Reject an empty object in the
validator('form')callback, or validate the result ofawait c.req.parseBody()in the handler.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono:
csrf()does not check requests sent by hyperlink auditing (text/ping)CVE-2026-126355 / GHSA-46wx-v44x-9hh2
More information
Details
Summary
csrf()validates a request only when itsContent-Typeis one of the three types an HTML form can send. Chromium's hyperlink auditing (<a ping>) sends a cross-origin POST with the user's cookies and the content typetext/ping, which is not in that list. The middleware does not look atOriginorSec-Fetch-Sitefor such a request, so it is passed to the handler.Details
The middleware skips the origin check when the content type is not one that a form submission produces. The assumption was that any other content type requires a CORS preflight and therefore cannot be sent cross-origin with credentials. Hyperlink auditing is an exception: Chrome and Edge send the ping as a credentialed POST without a preflight, with a fixed body and
Content-Type: text/ping.A page on another origin can therefore trigger a POST to any URL of the application. The
csrf()options fororiginandsecFetchSitedo not change the outcome, because neither header is evaluated for the request.The request body is fixed, so only actions whose effect does not depend on the body can be triggered. Firefox does not send pings by default. As with any CSRF, the user's cookie must be sent with the request, which with the default
SameSite=Laxmeans a same-site origin or a cookie set withSameSite=None.Impact
A user who visits a malicious page in Chrome or Edge while logged in to an application protected by
csrf()can be made to send a state-changing request to that application, such as logging out, deleting a resource, or toggling a setting that is selected by the path or query string.This issue affects applications that rely on
csrf()as their CSRF protection and expose state-changing endpoints whose effect does not depend on the request body.Workarounds
Reject requests with a
Content-Typeoftext/pingin a middleware registered beforecsrf(), or set session cookies withSameSite=Strict.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.13.16Compare Source
Security fixes
This release includes fixes for the following security issues:
mount()andapp.mount()can forward a path that bypasses middleware scoped inside the mount prefixAffects:
mount()inhono/mountandapp.mount(). A dynamic prefix such as/api/:tenant/*was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded\became/and..collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as/assets*and duplicate parameter names now throw. GHSA-4m76-xfj5-7975RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator
Affects:
RegExpRouter, including the defaultSmartRouter. Wildcard middleware was not applied in three cases: a parameter written as{[^/]+}in the middleware path only, a/prefix*route next to/prefix/*middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as{[0-9]*}, throwUnsupportedPathError. RegeneratePreparedRegExpRouterdata. GHSA-h7mg-cq63-vhpqvalidator('form')skips validation formultipart/form-datarequests with extra parametersAffects:
validator('form')inhono/validator. Amultipart/form-datarequest with an extra parameter such ascharsetwas not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2vcsshelper does not escape a closing tag assembled from template parts and values, allowing HTML injectionAffects:
cssinhono/css. A</style>split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6csrf()does not check requests sent by hyperlink auditing (text/ping)Affects:
csrf()inhono/csrf. A POST sent by Chromium's<a ping>has the content typetext/pingand was not checked againstOriginandSec-Fetch-Site. GHSA-46wx-v44x-9hh2Users who rely on path-scoped middleware with
mount(), wildcard middleware with the default router,validator('form'), thecsshelper with untrusted values, orcsrf()are strongly encouraged to upgrade to this version.What's Changed
critin #5597Full Changelog: honojs/hono@v4.13.15...v4.13.16
v4.13.15Compare Source
What's Changed
c.header()after the response body is consumed by @yusukebe in #5587Full Changelog: honojs/hono@v4.13.14...v4.13.15
v4.13.14Compare Source
What's Changed
honopeer range #5537d.ts#5557getPathwhenstrictisfalse#5563Full Changelog: honojs/hono@v4.13.13...v4.13.14
Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.