Source summary

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary , as the only child of a Context.Provider , or as the root value of renderToString() / renderToReadableStream() from hono/jsx/dom/server . Such a string is emitted as markup instead of text. Details These paths stringify their input and treat the result as already-escaped HTML, so a plain string passes through unchanged. Notable cases: - Suspense : a string child, or a string fallback while a child suspends. With streaming, the fallback reaches the browser in the initial chu

Affected

hono <4.13.7

Fixed in

4.13.7

ID

GHSA-hxh3-vqpv-xpqv

Source summary

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configure

Affected

hono >=4.12.4 <4.13.11

Fixed in

4.13.11

ID

GHSA-5r4p-p66f-jhc7