Starstruk Logo MarkStarstruk

v4.12.34

FireRedTeam/FireRedVADv4.12.34Aug 3, 2026by yusukebe

AI Summary

This release addresses critical security vulnerabilities affecting server-side rendering, CORS middleware, language processing, and proxy helpers.

Key Highlights

  • Fixed cross-user data disclosure in `memo()` SSR output.
  • Fixed ReDoS vulnerability in CORS middleware via Access-Control-Request-Headers.
  • Fixed algorithmic complexity DoS in language middleware.
  • Fixed Proxy Helper not removing connection-scoped headers.

New Features

  • Security patches for SSR data leakage.
  • Security patches for ReDoS and DoS vulnerabilities.

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### `memo()` retains SSR output across requests, leading to cross-user data disclosure

Affects: `hono/jsx` (server-side rendering). Fixes `memo()` reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — `useContext()`, `useRequestContext()`, or `getContext()` — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

### ReDoS in CORS middleware via `Access-Control-Request-Headers`

Affects: `hono/cors`. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the `Access-Control-Request-Headers` preflight header when `allowHeaders` is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

### Algorithmic complexity DoS in Language Middleware

Affects: `hono/language`. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or `Accept-Language` header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

### Proxy Helper does not remove response headers listed in the `Connection` header

Affects: `hono/proxy`. Fixes `proxy()` forwarding response headers that the origin's `Connection` header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use `hono/jsx` for server-side rendering, `hono/cors`, `hono/language`, or `hono/proxy` are strongly encouraged to upgrade to this version.