Update npm package hono to v4.13.5 [SECURITY] - #9608
Update npm package hono to v4.13.5 [SECURITY]#9608hash-dependencies[bot] wants to merge 1 commit into
hono to v4.13.5 [SECURITY]#9608Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
3 Skipped Deployments
|
PR SummaryLow Risk Overview 4.13.5 addresses query parsing that treated Reviewed by Cursor Bugbot for commit 608d9b2. Bugbot is set up for automated code reviews on this repo. Configure here. |
github-actions
Bot
added
area/deps
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 608d9b2. Configure here.
| "@local/hash-backend-utils": "workspace:*", | ||
| "@opentelemetry/api": "1.9.1", | ||
| "hono": "4.13.2", | ||
| "hono": "4.13.5", |
There was a problem hiding this comment.
Lockfile still pins vulnerable Hono
High Severity
package.json pins hono to 4.13.5, but yarn.lock still resolves 4.13.2. Immutable installs, including the brunch-agent Docker build, fail the update, so the CVE fixes never take effect.
Reviewed by Cursor Bugbot for commit 608d9b2. Configure here.
1 participant
This PR contains the following updates:
4.13.2→4.13.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
CVE-2026-84363 / GHSA-crvj-82cr-hjcx
More information
Details
Summary
Hono's query parsing does not stop at the URL fragment: a
?appearing after a#is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.Details
A fragment is never part of the query, and every standard URL consumer — browsers,
new URL(), reverse proxies — ignores everything from the first#onward. Hono's routing followed that rule; its query helpers did not.For one and the same request, this produces an interpretation differential:
The same divergence reaches request validation and any middleware that reads query parameters.
This requires a request target containing a literal
#to reach the application. Deployments on runtimes that normalise such a target — including Cloudflare Workers — are not affected, and neither are those behind an intermediary that strips the fragment.Impact
An attacker can cause the application to act on parameters that components in front of it never observe.
This may lead to:
This issue affects applications that read query parameters and run on a runtime that passes a literal
#through to the request URL.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Unbounded dot-notation nesting in
parseBody()can cause memory exhaustionCVE-2026-84364 / GHSA-g6gw-c38x-mqfc
More information
Details
Summary
When
parseBody()expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.Details
Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could encode one nesting level per byte.
Both shapes produce the effect: a single deeply dotted field name, and a large number of shallowly dotted ones within one body. A request body size limit does not prevent it, because the amplification happens after the body has been accepted.
Dot-notation parsing is not enabled by default.
Impact
An attacker who can reach an endpoint that parses request bodies with dot-notation enabled can send concurrent requests whose memory cost is disproportionate to their size.
This may lead to:
This issue affects applications that explicitly enable dot-notation parsing. Applications using the default behaviour are not affected.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Hono: Incomplete fix for CVE-2026-39408:
toSSG()still writes files outside the output directoryCVE-2026-84365 / GHSA-gqvv-2mrq-wpjv
More information
Details
Summary
The fix released for CVE-2026-39408 does not cover every traversal sequence.
toSSG()can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.Details
Static site generation builds each output path from the route path and the values supplied through
ssgParams, then verifies that the result stays inside the output directory. That check normalizes the path with the same routine that built it, and the routine did not fully collapse runs of consecutive parent-directory segments. A value carrying enough of them produces a path the check accepts, but the filesystem resolves outside the output directory.The earlier fix handled a single parent-directory segment, so it blocks the sequence reported at the time while leaving longer runs unhandled. The check also treated output directories that differ only in how they are rooted as equivalent.
This arises when an application generates a static site from route parameter values it does not fully control — slugs coming from a CMS, an API, or user submissions.
Impact
A value reaching
ssgParamsfrom an untrusted source can cause build output to be written outside the intended output directory, carrying whatever content the route handler produced.This may lead to:
This affects build-time static site generation only; request-time routing is not affected. Applications whose
ssgParamsvalues are entirely developer-controlled are not affected.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.13.5Compare Source
Security fixes
This release includes fixes for the following security issues:
Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a
?after a#was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcxIncomplete fix for CVE-2026-39408:
toSSG()still writes files outside the output directoryAffects:
toSSG()for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments inssgParamsvalues were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjvUnbounded dot-notation nesting in
parseBody()can cause memory exhaustionAffects:
parseBody()when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfcUsers who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use
parseBody({ dot: true })are strongly encouraged to upgrade to this version.v4.13.4Compare Source
What's Changed
Full Changelog: honojs/hono@v4.13.3...v4.13.4
v4.13.3Compare Source
What's Changed
Full Changelog: honojs/hono@v4.13.2...v4.13.3
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.