Key Points
- app.mount percent-encoding fix
- IPv6 deny-bypass resolved
- Set-Cookie and JWT validation hardened
Summary
This release (2026-05-19) is a security patch addressing multiple vulnerabilities across hono core and plugins. It fixes incorrect mount prefix stripping for percent-encoded paths, IPv6 bypasses in IP restriction checks, Set-Cookie attribute injection, and missing scheme validation in JWT auth.
Key Points
- Affected packages: app.mount(), hono/ip-restriction, hono/cookie, hono/jwt and hono/jwk.
- app.mount(): now strips the mount prefix using the raw URL pathname to avoid incorrect routing when percent-encoded characters are present.
- IP restriction: fixed IPv6/address comparison so non-canonical IPv6 representations (compressed, hex IPv4-mapped) no longer bypass static deny rules.
- Cookie helper: validates sameSite and priority against injection characters (";", CR, LF) to prevent Set-Cookie header injection.
- JWT middleware: enforces that the Authorization header uses the Bearer scheme; other two-part schemes will no longer be treated as valid.
- Recommended action: upgrade to v4.12.21 immediately if you use any of the affected features.
Practical notes for engineers
- If you cannot upgrade immediately:
- Avoid mounting apps using percent-encoded mount prefixes or normalize/validate paths before mount.
- Normalize IPv6 addresses for comparison (use canonical/binary form) or place IP filtering behind a trusted proxy.
- Sanitize / whitelist sameSite and priority values before passing to the cookie helper.
- Enforce
Authorization: Bearer ...validation in front of or within your auth middleware.
References
- GHSA-2gcr-mfcq-wcc3, GHSA-xrhx-7g5j-rcj5, GHSA-3hrh-pfw6-9m5x, GHSA-f577-qrjj-4474