Starstruk Logo MarkStarstruk

v4.12.18

honojs/honov4.12.18May 6, 2026by yusukebe

AI Summary

Security-focused release addressing three critical vulnerabilities in Cache Middleware, JSX SSR, and JWT verify(). Users of JWT helper, hono/jsx, or Cache middleware are strongly encouraged to upgrade.

Key Highlights

  • Fixes Cache Middleware cross-user cache leakage via missing Vary: Authorization/Cookie handling (GHSA-p77w-8qqv-26rm)
  • Fixes CSS Declaration Injection via Style Object Values in JSX SSR (GHSA-qp7p-654g-cw7p)
  • Fixes improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() (GHSA-hm8q-7f3q-5f36)

New Features

  • Security fix: Cache Middleware now properly handles Vary: Authorization and Vary: Cookie headers to prevent cross-user cache leakage
  • Security fix: CSS-context escape added for style object values and property names in JSX SSR to prevent CSS declaration injection
  • Security fix: JWT verify() now properly rejects falsy, non-finite, or non-numeric values for exp, nbf, and iat claims per RFC 7519

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for `Vary: Authorization` and `Vary: Cookie`, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

### CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for `style` object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

### Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: `hono/utils/jwt`. Fixes improper validation of `exp`, `nbf`, and `iat` claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

---

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.