HonoProduct update

Hono · v4.12.34

Hono v4.12.34 fixes four security issues: memo() in hono/jsx reused a render result across requests when props compared equal and could serve HTML rendered for another user, disclosing account data or secrets such as CSRF tokens (GHSA-f23p-vx2j-j53r), and when allowHeaders is not configured, which is the default, hono/cors parsed the preflight request header with a regular expression that had quadratic backtracking and could be used to consume CPU (GHSA-8j4g-w8fx-2239). Language-tag normalization in hono/language had quadratic complexity, so a crafted tag could cause excessive CPU consumption (GHSA-54fx-42gc-7vw4), and hono/proxy forwarded response headers that the origin's Connection header marked as connection-scoped (GHSA-79qm-7rj5-m7r9).

GitHub ReleasesAug 3, 20261 min read