Summary

Release v4.12.27 (2026-06-23) fixes three security issues across hono packages. Users of hono/jsx, hono/jsx-renderer, hono/css (cx()), and hono/aws-lambda API Gateway v1 / VPC Lattice adapters should upgrade immediately.

Key Points

• SSR context leak (hono/jsx, hono/jsx-renderer) — Context was stored process-wide instead of per-request, so useContext()/useRequestContext() called after an await in async components could return another concurrent request's value, enabling cross-request data disclosure or incorrect authorization. (GHSA-hvrm-45r6-mjfj)
• Server-side XSS via cx() (hono/css) — cx() treated composed class names as pre-escaped and did not escape input, allowing untrusted class name input to break out of a JSX class attribute during SSR and inject markup. (GHSA-w62v-xxxg-mg59)
• API Gateway v1 / VPC Lattice header deduplication (hono/aws-lambda) — The adapter de-duplicated repeated header values by substring instead of exact match, dropping values that were substrings of others (e.g. affecting X-Forwarded-For) which can break IP-based logic. (GHSA-xgm2-5f3f-mvvc)

Recommended Actions

• Upgrade to v4.12.27 immediately.
• Audit server-side code that: uses async JSX components with useRequestContext/useContext; passes untrusted strings to cx()/class name utilities; relies on repeated header values (e.g. X-Forwarded-For).
• As a temporary mitigation: avoid using untrusted input directly as class names, validate/sanitize header parsing logic, and add logging around auth/authorization decisions affected by request context or headers.

Notes for Engineers

• These are security fixes; treat as high priority for production environments that perform SSR, use custom class name inputs, or run on API Gateway v1 / VPC Lattice.
• Refer to the GHSA advisories listed above for CVE/GHSA tracking and upgrade guidance.