fix(deps): update dependency hono to v4.12.34 [security]

[mike12806]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.33 → 4.12.34

---

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207 / GHSA-8j4g-w8fx-2239

More information

Details

Summary

The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.

Details

On a CORS preflight, when allowHeaders is not configured - the default - the middleware reflects and parses the Access-Control-Request-Headers value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.

Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.

This issue arises for any application using cors() with the default (or an empty) allowHeaders. Applications that set a non-empty allowHeaders do not reach the affected path.

Impact

An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
• https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-8j4g-w8fx-2239

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.12.34

Compare Source

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.