LoginSign Up
← Back to all sparks
H

Hono

DEVOPS
Velocity5.0

Ultrafast web framework for the edge

hono.dev ↗

Hono's news has moved from features to hardening — the 4.12 line is patching trust boundaries.

edge-runtimesecurity-hardeningadapter-maintenancessr-isolationpatch-cadence
◆Current state
Hono is deep into a maintenance cadence on the 4.12 line, shipping roughly weekly with no new framework surface. The substance sits in two places: the runtime adapters — AWS Lambda, Lambda@Edge, Cloudflare Workers — where content-encoding, JWT authorizer types and base64 handling keep needing correction, and the HTTP primitives themselves, where cookie parsing, SSE framing and multipart boundaries get incremental fixes. The 4.12.34 release breaks that rhythm with two security advisories.
◆Where it's heading
The framework surface is settled; what is still moving is the trust boundary around it. Query, header and param parsing switched to Object.create(null), CSP callbacks got scoped to their own header, and now a memo() cache in the JSX SSR path is fixed for leaking one user's rendered HTML into another's request. Taken together this reads as a project whose adoption has outrun its threat modelling, and which is now retrofitting isolation into paths written when Hono was smaller.
◆Prediction
Expect the weekly patch cadence to continue with adapter fixes as the bulk, and expect further hardening in the JSX/SSR layer specifically — the memo() disclosure suggests request-scoped state there has not been fully audited.

◆Recent moves

  1. 7d ago

    Security fixes: SSR memo() cross-user leak, CORS ReDoS

    Two advisories land at once: hono/jsx memo() reused a retained SSR render across requests when props compared equal, so a component reading request-scoped context could serve another user's HTML including CSRF tokens, and hono/cors carried a whitespace-tolerant regex vulnerable to ReDoS. The clearest evidence yet that Hono's hardening phase is about request isolation.

    View source ↗
  2. 10d ago

    Cookie parsing relaxed, undici dropped for global fetch

    Relaxed cookie name validation on parse, a useSyncExternalStore subscription fix in JSX, and undici removed in favour of global fetch. Routine upkeep consistent with the settled-surface phase.

    View source ↗
  3. 17d ago

    Prototype-pollution hardening in query, header and param parsing

    Query, header and param parsing move to Object.create(null), and secure-headers keeps CSP callbacks scoped to their own header. Alongside AWS Lambda authorizer types and an SSE fix, this is the hardening trajectory showing up weeks before the 4.12.34 advisories made it explicit.

    View source ↗
  4. 22d ago

    Multipart boundary and SSE retry-field corrections

    A multipart boundary mismatch in cloneRawRequest, cached formData reuse in parseBody, and SSE emitting the retry field when it is zero. Small correctness repairs in the HTTP primitives layer.

    View source ↗
  5. 28d ago

    Cache-Control dedup and 206 compression fixes

    Cache-Control directives deduplicated case-insensitively, 206 Partial Content responses no longer compressed, and a client param-matching fix. Middleware-level corrections with no change in capability.

    View source ↗
  6. 1mo ago

    Lambda@Edge base64 and content-encoding handling fixes

    Lambda@Edge now base64-encodes content-encoded bodies and resolves handlers from the callback value, with any non-identity content-encoding treated as binary. Adapter maintenance, which is where most of this release line's volume lives.

    View source ↗