v4.12.16

honojs/honov4.12.16Apr 30, 2026by yusukebe

AI Summary

Security-focused release addressing two vulnerabilities in the Hono framework. Fixes unvalidated JSX tag names that could allow HTML injection when using jsx() or createElement(), and resolves a bodyLimit() bypass vulnerability for chunked or unknown-length requests where oversized requests could reach handlers before being rejected.

Key Highlights

Fixed unvalidated JSX tag names in hono/jsx preventing HTML injection (GHSA-69xw-7hcm-h432)
Fixed bodyLimit() middleware bypass for chunked/unknown-length requests (GHSA-9vqf-7f2p-gf9v)
Both are critical security fixes

New Features

Security fix: Unvalidated JSX tag names in hono/jsx - adds validation for jsx() and createElement() to prevent HTML injection when untrusted input is used as tag name
Security fix: bodyLimit() bypass - enforces body size limits for requests without Content-Length (e.g., chunked requests) to prevent oversized requests from reaching handlers

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using `jsx()` or `createElement()`, which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

### bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v