chore(deps): update dependency hono to v4.12.25 [security] - #760
Merged
Conversation
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
JSONbored
approved these changes
Jun 16, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #760 +/- ##
=======================================
Coverage 96.59% 96.59%
=======================================
Files 91 91
Lines 13646 13646
Branches 4975 4975
=======================================
Hits 13182 13182
Misses 97 97
Partials 367 367 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
JSONbored
added a commit
that referenced
this pull request
Jun 16, 2026
Two follow-ups from the coverage-gate change (#763) and the duplicate hono advisory PRs (#760 from Renovate, #761 from Dependabot security updates): - prBodyNotes referenced the old "97% global coverage gate" that #763 replaced. Update it to describe the Codecov patch-coverage gate so Renovate stops stamping stale guidance on every dependency PR. - Record that Renovate is the sole dependency/security bot. GitHub Dependabot security updates has been disabled at the repo level (automated-security-fixes) so a single advisory no longer produces two PRs; Renovate's vulnerabilityAlerts continues to cover security advisories.
JSONbored
added a commit
that referenced
this pull request
Jun 16, 2026
Two follow-ups from the coverage-gate change (#763) and the duplicate hono advisory PRs (#760 from Renovate, #761 from Dependabot security updates): - prBodyNotes referenced the old "97% global coverage gate" that #763 replaced. Update it to describe the Codecov patch-coverage gate so Renovate stops stamping stale guidance on every dependency PR. - Record that Renovate is the sole dependency/security bot. GitHub Dependabot security updates has been disabled at the repo level (automated-security-fixes) so a single advisory no longer produces two PRs; Renovate's vulnerabilityAlerts continues to cover security advisories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.12.23→4.12.25Dependency PRs must keep
npm run test:cipassing and preserve the 97% global coverage gate.GitHub Actions updates must remain SHA-pinned.
hono: AWS Lambda adapter merges multiple
Set-Cookieheaders into one value, dropping cookies on ALB single-header and LatticeCVE-2026-54287 / GHSA-j6c9-x7qj-28xf
More information
Details
Summary
On AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple
Set-Cookieheaders into one comma-separated value. Because commas also appear inside cookie attributes (for exampleExpiresdates), clients cannot split the value back into individual cookies and silently drop or misparse them.Details
Per RFC 6265, each cookie must be its own
Set-Cookieheader line, and commas may appear inside attribute values. Joining cookies with", "collides with those commas, producing a value that clients cannot reliably split. Only ALB single-header mode and VPC Lattice v2 are affected; API Gateway v1/v2 and ALB with multi-value headers enabled already use an array and are unaffected.Impact
A client may receive only one of the cookies, a malformed cookie, or none. Session, CSRF, or preference cookies can silently fail to apply, breaking sessions or forcing re-authentication. This affects applications that set multiple cookies per response and run on AWS Lambda behind an ALB in single-header mode (the default) or VPC Lattice v2.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Path traversal in
serve-staticon Windows via encoded backslash (%5C)CVE-2026-54286 / GHSA-wwfh-h76j-fc44
More information
Details
Summary
On Windows hosts, an encoded backslash (
%5C) in the request path decodes to\, which the Windows path resolver treats as a separator.serve-staticthen resolves a single URL segment such asadmin\secret.txtinto a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.Details
The router splits paths only on
/, so/admin%5Csecret.txtis one segment and middleware on/admin/*does not run. Theserve-staticguard rejects./..and consecutive separators but lets a lone\through; on Windows the file resolver re-splits it into the protected subtree.This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.
Impact
An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: CORS Middleware reflects any Origin with credentials when
origindefaults to the wildcardCVE-2026-54290 / GHSA-88fw-hqm2-52qc
More information
Details
Summary
With
credentials: trueand no explicitorigin(the default wildcard), the CORS Middleware reflects the request'sOriginand sendsAccess-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.Details
The spec forbids
Access-Control-Allow-Origin: *with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the requestOrigininstead, so it now succeeds for every origin, includingnull. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.This issue arises when an application enables
credentials: trueand leavesoriginunset or set to the wildcard.Impact
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting
origin.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
CVE-2026-54289 / GHSA-wgpf-jwqj-8h8p
More information
Details
Summary
On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with
Headers.setinstead ofHeaders.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such asX-Forwarded-For,Forwarded, andViaare silently truncated to a single value.Details
A repeated request header carries an ordered list of values. The adapter iterates the list but overwrites on each step, keeping only the final value. Middleware that depends on the full list — for example IP restriction that walks the
X-Forwarded-Forchain, or auditing based onForwarded/Viahops — receives incomplete data. The API Gateway adapter already appends repeated values and is not affected.This issue arises only on Lambda@Edge deployments, for requests that contain the same header more than once.
Impact
Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the
X-Forwarded-Forchain, this can weaken or alter that decision; for auditing, hop history is lost. This affects applications deployed on AWS Lambda@Edge that rely on multi-value request headers.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating
Content-LengthCVE-2026-54288 / GHSA-rv63-4mwf-qqc2
More information
Details
Summary
The Body Limit Middleware trusts the request's
Content-Lengthheader to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declaredContent-Length, which need not match the actual payload. A client can declare a tinyContent-Lengthwhile sending a much larger body, slipping past the limit.Details
When
Content-Lengthis present andTransfer-Encodingis absent, the middleware compares the declared value against the limit and passes the request through if it is small enough. On standards-based runtimes the transport enforces thatContent-Lengthmatches the body, so this is safe. The Lambda adapters instead reconstruct the request from a buffered payload and copy the client'sContent-Lengthverbatim, so the declared length and the real body size are decoupled.This issue affects applications deployed on AWS Lambda that rely on the Body Limit Middleware to cap request body size.
Impact
The declared body-size limit can be bypassed: a handler reads a payload larger than the configured maximum. Processing the oversized payload (large JSON, multipart, etc.) consumes additional CPU and memory per request. The payload remains bounded by the platform's request size limits, and Lambda isolates invocations, so the impact is increased per-request resource usage rather than full denial of service. This affects applications deployed on AWS Lambda that use the Body Limit Middleware.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.12.25Compare Source
v4.12.24Compare Source
Configuration
📅 Schedule: (in timezone America/Phoenix)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.