Hono 4.13.16 fixes five ways a request could slip past middleware
Serguey Asael Shinder1 min readThe Hono web framework released version 4.13.16 on 1 November with five security fixes, each with its own GitHub advisory. The project strongly encourages anyone using the affected features to upgrade.
The first concerns mount() and app.mount(). A dynamic prefix such as /api/:tenant/ was stripped by the length of the route pattern, and the forwarded path was re-normalised by the URL parser, so a decoded backslash became a slash and ".." collapsed; both let a crafted request skip middleware scoped inside the mount prefix (GHSA-4m76-xfj5-7975). Routes such as /assets and duplicate parameter names now throw. The second is in RegExpRouter, which is also behind the default SmartRouter: wildcard middleware was not applied in three cases, including a /prefix* route next to /prefix/* middleware and a path with an encoded line terminator (GHSA-h7mg-cq63-vhpq).
The other three: validator('form') treated a multipart/form-data request with an extra parameter such as charset as not being a form, so it validated an empty object while the handler could read every field (GHSA-4h7h-rv7c-7m2v); the css helper did not escape a closing style tag split between template parts and values (GHSA-3gg2-335m-rxc6); and csrf() did not check POST requests sent by Chromium's a-ping hyperlink auditing, which arrive as text/ping (GHSA-46wx-v44x-9hh2). The release also makes the JWT helper reject a signature outside the base64url alphabet and headers carrying crit.
What it means
Four of the five are the same shape of bug: a check that runs on one representation of the request while the handler sees another. That is the class worth testing for in any router, not only Hono. Upgrading has two side effects worth knowing before deploying: route patterns like /assets* and custom patterns that can match an empty string now throw at registration, and PreparedRegExpRouter data has to be regenerated.