v4.12.25

概要

公開日: 2026-06-09 翻訳生成に失敗したため、原文をそのまま保存しています。

原文

honojs / hono Public Uh oh! There was an error while loading. Please reload this page . Notifications You must be signed in to change notification settings Fork 1.1k Star 30.9k Code Issues 264 Pull requests 105 Discussions Actions Security and quality 40 Insights Additional navigation options Code Issues Pull requests Discussions Actions Security and quality Insights Releases v4.12.25 v4.12.25 Latest Latest Compare Choose a tag to compare Sorry, something went wrong. Filter Loading Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page . No results found View all tags yusukebe released this 09 Jun 03:30 · 1 commit to main since this release v4.12.25 fce483e Security fixes This release includes fixes for the following security issues: CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard Affects: hono/cors . Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin , where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length Affects: hono/body-limit on AWS Lambda ( hono/aws-lambda , hono/lambda-edge ). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2 Path traversal in serve-static on Windows via encoded backslash ( %5C ) Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash ( %5C ) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44 AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice Affects: hono/aws-lambda . Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Affects: hono/lambda-edge . Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p Assets 2 Loading Uh oh! There was an error while loading. Please reload this page . --> 👍 2 marr-cloud and quentinmcq reacted with thumbs up emoji ❤️ 3 hanacus87, sant123, and orielhaim reacted with heart emoji All reactions 👍 2 reactions ❤️ 3 reactions 5 people reacted