🚨 [security] Update hono 4.11.1 → 4.11.10 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ hono (4.11.1 → 4.11.10) · Repo

Security Advisories 🚨

🚨 Hono added timing comparison hardening in basicAuth and bearerAuth

Summary

The basicAuth and bearerAuth middlewares previously used a comparison that was not fully timing-safe.

The timingSafeEqual function used normal string equality (===) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.

The implementation has been updated to use a safer comparison method.

Details

The issue was caused by the use of normal string equality (===) when comparing hash values inside the timingSafeEqual function.

In JavaScript, string comparison may stop as soon as a difference is found. This means the comparison time can slightly vary depending on how many characters match.

Under very specific and controlled conditions, this behavior could theoretically allow timing-based analysis.

The implementation has been updated to:

• Avoid early termination during comparison
• Use a constant-time-style comparison method

Impact

This issue is unlikely to be exploited in normal environments.

It may only be relevant in highly controlled situations where precise timing measurements are possible.

This change is considered a security hardening improvement. Users are encouraged to upgrade to the latest version.

🚨 Hono vulnerable to XSS through ErrorBoundary component

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the ErrorBoundary component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser.

Details

The issue is in the ErrorBoundary component (src/jsx/components.ts). ErrorBoundary previously forced certain rendered output paths to be treated as raw HTML, bypassing the library's default escaping behavior. This could result in unescaped rendering when developers pass user-controlled strings directly as children, or when fallbackRender returns user-controlled strings (for example, reflecting error messages that contain attacker input).

This vulnerability is only exploitable when an application renders untrusted user input within ErrorBoundary without appropriate escaping or sanitization.

Impact

Successful exploitation may allow attackers to execute arbitrary JavaScript in the victim’s browser (reflected XSS). Depending on the application context, this can lead to actions such as session compromise, data exfiltration, or performing unauthorized actions as the victim.

Affected Components

• hono/jsx: ErrorBoundary component

🚨 Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Summary

Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys.

Details

The vulnerability exists in the serve-static middleware used with the Cloudflare Workers adapter. When serving static assets, the middleware does not sufficiently validate or restrict user-supplied paths before resolving them against the Workers asset storage.

As a result, an attacker may craft requests that access arbitrary keys beyond the intended static asset scope. This issue only affects applications running on Cloudflare Workers that use Serve static Middleware with user-controllable request paths.

Impact

This vulnerability may lead to information disclosure by allowing unauthorized access to internal assets or data stored in the Workers environment. The exposed data is limited to readable asset keys and does not allow modification of stored data or execution of arbitrary code.

The impact is limited to applications that use Serve static Middleware in the Cloudflare Workers adapter and rely on it to safely handle untrusted request paths.

Affected Components

• Serve static Middleware (Cloudflare Workers adapter)

🚨 Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

Summary

Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as Cache-Control: private or Cache-Control: no-store, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users.

Details

The vulnerability exists in the cache decision logic of Cache Middleware. When determining whether a response should be cached, the middleware does not take HTTP cache control semantics into account and may cache responses that are explicitly marked as private by the application. While some runtimes, such as Cloudflare Workers, enforce cache control restrictions at the platform level, other runtimes including Deno, Bun, and Node.js rely on the middleware’s behavior. As a result, applications running on these runtimes may unintentionally cache sensitive responses.

Impact

This issue can lead to Web Cache Deception and information disclosure. If an authenticated user accesses an endpoint that returns user-specific or sensitive data and the response is cached despite being marked as private, subsequent unauthenticated requests may receive the cached response. This may result in the exposure of personally identifiable information or session-related data. The impact is limited to applications that use the hono/cache middleware and rely on it to correctly honor HTTP cache control directives.

Affected Components

• Cache Middleware

🚨 Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Summary

IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4_REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls.

Details

The vulnerability exists in two components:

1. Permissive regex pattern: The IPV4_REGEX (/^[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}$/) accepts octet values greater than 255 (e.g., 999).
2. Unsafe binary conversion: The convertIPv4ToBinary function does not validate octet ranges before performing bitwise operations. When an octet exceeds 255, it overflows into adjacent octets during the bit-shift calculation.

For example, the IP address 1.2.2.355 is accepted and converts to the same binary value as 1.2.3.99:

• 355 = 256 + 99 = 0x163
• After bit-shifting: (1 << 24) + (2 << 16) + (2 << 8) + 355 = 0x01020363 = 1.2.3.99

Impact

An attacker can bypass IP-based restrictions by crafting malformed IP addresses:

• Blocklist bypass: If 1.2.3.0/24 is blocked, an attacker can use 1.2.2.355 (or similar) to bypass the restriction.
• Allowlist bypass: Requests from unauthorized IP ranges may be incorrectly permitted.

This is exploitable when the application relies on client-provided IP addresses (e.g., X-Forwarded-For header) for access control decisions.

Affected Components

• IP Restriction Middleware
• src/utils/ipaddr.ts: IPV4_REGEX, convertIPv4ToBinary, distinctRemoteAddr

🚨 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

Summary

A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.

Details

When verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s alg field if present, but otherwise fell back to the alg value provided in the unverified JWT header.

Because the alg field in a JWK is optional and often omitted in real-world JWKS configurations, this behavior could allow an attacker to control the algorithm used for verification. In some environments, this may lead to authentication or authorization
bypass through crafted tokens.

The practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used for authorization decisions.

Impact

In affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially resulting in authentication or authorization bypass.

Applications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.

Resolution

Update to the latest patched release.

Breaking change:

As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values.

Applications upgrading must update their configuration accordingly.

Before (vulnerable configuration)

import { jwt } from 'hono/jwt'
app.use(

'/auth/*',

jwt({

secret: 'it-is-very-secret',

// alg was optional

})

)

After (patched configuration)

import { jwt } from 'hono/jwt'
app.use(

'/auth/*',

jwt({

secret: 'it-is-very-secret',

alg: 'HS256', // required

})

)

🚨 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

Summary

A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.

Details

When verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s alg field if present. If the JWK did not specify an algorithm, the middleware fell back to using the alg value provided in the unverified JWT header.

Because the alg field in a JWK is optional and commonly omitted in real-world JWKS configurations, this behavior could allow an attacker to influence which algorithm is used for verification. In some environments, this may result in authentication or authorization bypass through crafted JWTs.

The practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used to make authorization decisions.

Impact

In affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially leading to authentication or authorization bypass.

Applications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.

Resolution

Update to the latest patched release.

Breaking change:

The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values.

Instead, callers must explicitly specify which asymmetric algorithms are permitted, and only tokens signed with those algorithms will be accepted. This prevents JWT algorithm confusion by ensuring that algorithm selection is fully controlled by application
configuration.

As part of this fix, the alg option is now required when using the JWK/JWKS middleware, and symmetric (HS*) algorithms are no longer accepted in this context.

Before (vulnerable configuration)

import { jwk } from 'hono/jwk'
app.use(

'/auth/*',

jwk({

jwks_uri: 'https://example.com/.well-known/jwks.json',

// alg was optional

})

)

After (patched configuration)

import { jwk } from 'hono/jwk'
app.use(

'/auth/*',

jwk({

jwks_uri: 'https://example.com/.well-known/jwks.json',

alg: ['RS256'], // required: explicit asymmetric algorithm allowlist

})

)

Release Notes

4.11.10

What's Changed

• fix: fixed to be more properly timing safe (Merge commit from fork 91def7c)

Full Changelog: v4.11.9...v4.11.10

4.11.9

What's Changed

• fix(url): ignore fragment identifiers in getPath() by @sano-suguru in #4627
• fix: determine if rendered or not by node.vC[0] instead of referring to node.pP by @usualoma in #4663

Full Changelog: v4.11.8...v4.11.9

4.11.8

What's Changed

• fix(jsx): preserve context when using await before html helper by @kaigritun in #4662
• fix(bearer-auth): make auth-scheme case-insensitive by @bytaesu in #4659

New Contributors

• @kaigritun made their first contribution in #4662

Full Changelog: v4.11.7...v4.11.8

4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

• Use IP Restriction Middleware
• Use Cache Middleware on Deno, Bun, or Node.js
• Use Serve Static Middleware with user-controlled paths on Cloudflare Workers
• Render untrusted data inside ErrorBoundary components

Security Advisories & CVEs

• IP Restriction Middleware – IPv4 address validation bypass

  • Advisory: GHSA-r354-f388-2fhh
  • CVE: CVE-2026-24398

• Cache Middleware ignores Cache-Control: private

  • Advisory: GHSA-6wqw-2p9w-4vw4
  • CVE: CVE-2026-24472

• Serve Static Middleware (Cloudflare Workers adapter) – Arbitrary key read

  • Advisory: GHSA-w332-q679-j88p
  • CVE: CVE-2026-24473

• hono/jsx ErrorBoundary – Cross-Site Scripting (XSS)

  • Advisory: GHSA-9r54-q6cx-xmh5
  • CVE: Pending

---

Full Changelog: v4.11.6...v4.11.7

4.11.6

What's Changed

• refactor: use unique symbol for more accurate typing. by @usualoma in #4651
• docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant by @sano-suguru in #4630
• fix(sse): handle \r and \r\n line endings in writeSSE by @AprilNEA in #4644
• feat(bun): export getBunServer by @artemtam in #4626

New Contributors

• @sano-suguru made their first contribution in #4630
• @AprilNEA made their first contribution in #4644
• @artemtam made their first contribution in #4626

Full Changelog: v4.11.5...v4.11.6

4.11.5

What's Changed

• fix(client): exclude $all from ClientRequest type by @paveg in #4611
• refactor(jwks): mark allowedAlgorithms, so the user can pass a `const… by @nikeee in #4641
• feat(jwt): export AlgorithmTypes by @yusukebe in #4642

New Contributors

• @paveg made their first contribution in #4611
• @nikeee made their first contribution in #4641

Full Changelog: v4.11.4...v4.11.5

4.11.4

Security

Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware.

Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values.

If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible.

JWT middleware

import { jwt } from 'hono/jwt'
app.use(

'/auth/*',

jwt({

secret: 'it-is-very-secret',

alg: 'HS256', // required

})

)

JWK/JWKS middleware

import { jwk } from 'hono/jwk'
app.use(

'/auth/*',

jwk({

jwks_uri: 'https://example.com/.well-known/jwks.json',

alg: ['RS256'], // required (asymmetric algorithms only)

})

)

For more details, see the Security Advisory.

• GHSA-f67f-6cw9-8mq4
• GHSA-3vhc-576x-3qv4

What's Changed

• test(utils/jwt): add missing algorithm types in jwa.test.ts by @flathill404 in #4607
• chore: bump @hono/eslint-config and enable curly rule by @yusukebe in #4620
• docs(bun/websocket): Fixed a typo in hono/bun deprecation message and updated test. by @Itsnotaka in #4618
• test: support alg option for JWT middleware by @yusukebe in #4624

New Contributors

• @flathill404 made their first contribution in #4607
• @Itsnotaka made their first contribution in #4618

Full Changelog: v4.11.3...v4.11.4

4.11.3

What's Changed

• fix(types): fix middleware union type merging in MergeMiddlewareResponse by @yusukebe in #4602

Full Changelog: v4.11.2...v4.11.3

4.11.2

What's Changed

• docs: improve grammar in contributing documentation by @Ishiezz in #4581
• fix(validator): preserve literal union types in input type inference by @yusukebe in #4583
• chore: bump typescript-go preview for accurate benchmarking by @sushichan044 in #4586
• refactor(hono-base): add type annotations by @yusukebe in #4591
• refactor(client): refactor HonoURL types by @yusukebe in #4592
• perf(types): reduce Simplify in ToSchema by @yusukebe in #4597
• perf(types): optimize MergeMiddlewareResponse type by @yusukebe in #4598

New Contributors

• @Ishiezz made their first contribution in #4581

Full Changelog: v4.11.1...v4.11.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

• 4.11.10
• Merge commit from fork
• test(types): add regression tests for #4388 (routes before .use() with explicit paths) (#4722)
• doc(jwt): mark `options.secret` as required in JSDoc (#4718)
• chore(ci): bump typescript-go to the latest (#4716)
• chore: update Zod import examples to use namespace imports (#4715)
• 4.11.9
• fix: determine if rendered or not by `node.vC[0]` instead of referring to `node.pP` (#4663)
• fix(url): ignore fragment identifiers in getPath() (#4627)
• 4.11.8
• fix(bearer-auth): make auth-scheme case-insensitive (#4659)
• fix(jsx): preserve context when using await before html helper (#4662)
• 4.11.7
• Merge commit from fork
• Merge commit from fork
• Merge commit from fork
• Merge commit from fork
• 4.11.6
• feat(bun): export getBunServer (#4626)
• fix(sse): handle `\r` and `\r\n` line endings in writeSSE (#4644)
• docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (#4630)
• refactor: use `unique symbol` for more accurate typing. (#4651)
• 4.11.5
• feat(jwt): export `AlgorithmTypes` (#4642)
• refactor(jwks): mark allowedAlgorithms, so the user can pass a `const` array (#4641)
• fix(client): exclude $all from ClientRequest type (#4611)
• 4.11.4
• Merge commit from fork
• test: support `alg` option for JWT middleware (#4624)
• Merge commit from fork
• docs(bun/websocket): Fixed a typo in hono/bun deprecation message and updated the corresponding test (#4618)
• chore: bump `@hono/eslint-config` and enable curly rule (#4620)
• test(utils/jwt): add missing algorithm types in jwa.test.ts (#4606) (#4607)
• 4.11.3
• fix(types): fix middleware union type merging in MergeMiddlewareResponse (#4602)
• 4.11.2
• perf(types): optimize `MergeMiddlewareResponse` type (#4598)
• perf(types): reduce `Simplify` in `ToSchema` (#4597)
• refactor(client): refactor `HonoURL` types (#4592)
• refactor(hono-base): add type annotations (#4591)
• chore: bump typescript-go preview for accurate benchmarking (#4586)
• fix(validator): preserve literal union types in input type inference (#4583)
• docs: improve grammar in contributing documentation (#4581)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.11.1 ⏵ 4.11.10	+1	+28	+1	+1

View full report

[depfu]

Closed in favor of #5.

[depfu]

Closed in favor of #7.

[depfu]

Closed in favor of #9.

[depfu]

Closed in favor of #9.