Starstruk Logo MarkStarstruk

v4.12.14

honojs/honov4.12.14Apr 15, 2026by yusukebe

AI Summary

A security-focused release addressing improper handling of JSX attribute names in hono/jsx SSR that could allow malformed attribute keys to corrupt HTML output and inject unintended attributes. Also includes a fix for handling invalid header names in AWS Lambda request processing.

Key Highlights

  • Security fix for JSX attribute name validation in SSR (GHSA-458j-xx4x-4375)
  • Fix for invalid header names in AWS Lambda request processing (#4883)

New Features

  • JSX attribute name validation in server-side rendering
  • AWS Lambda invalid header name handling

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

## Other changes

- fix(aws-lambda): handle invalid header names in request processing (#4883)  fa2c74fe