Summary

v4.12.16 addresses two security issues: unvalidated JSX tag names in hono/jsx that could allow HTML injection, and a bypass of bodyLimit() for chunked or unknown-length requests where oversized bodies could reach handlers. Release published 2026-04-30.

Key Points

• Affected: hono/jsx — validation added for JSX tag names used with jsx() and createElement() to prevent HTML injection (GHSA-69xw-7hcm-h432). Avoid using untrusted input as a tag name until patched.
• Affected: Body Limit Middleware — bodyLimit() now enforces limits for chunked/unknown-length requests; previously oversized requests could bypass enforcement and reach handlers (GHSA-9vqf-7f2p-gf9v).
• Action: Upgrade to v4.12.16 immediately. Test middleware behavior and input handling in your app, and continue validating untrusted input on the application side.

Upgrade

• npm: npm install hono@4.12.16
• yarn: yarn add hono@4.12.16
• Verify request handling for chunked uploads and any code that dynamically constructs JSX tag names.