v4.12.21
honojs/honov4.12.21May 19, 2026by yusukebe
AI Summary
Security-focused release addressing four vulnerabilities in app.mount(), ip-restriction, cookie, and jwt/jwk middlewares. Users of these components are strongly encouraged to upgrade.
Key Highlights
- Fixed app.mount() prefix stripping to use raw URL pathname instead of decoded path
- Fixed IP Restriction bypass for non-canonical IPv6 addresses using string equality comparison
- Fixed Cookie helper missing sanitization for sameSite and priority options
- Fixed JWT middleware accepting any Authorization scheme instead of only Bearer
New Features
- Security fix: app.mount() now strips mount prefix using raw URL pathname (GHSA-2gcr-mfcq-wcc3)
- Security fix: IP Restriction now properly handles non-canonical IPv6 representations (GHSA-xrhx-7g5j-rcj5)
- Security fix: Cookie helper now validates sameSite and priority against injection characters (GHSA-3hrh-pfw6-9m5x)
- Security fix: JWT middleware now validates Authorization header scheme is 'Bearer' (GHSA-f577-qrjj-4474)
Full Release Notes
## Security fixes This release includes fixes for the following security issues: ### app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Affects: `app.mount()`. Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3 ### IP Restriction bypasses static deny rules for non-canonical IPv6 Affects: `hono/ip-restriction`. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5 ### Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Affects: `hono/cookie`. Fixes missing validation of `sameSite` and `priority` options against injection characters (`;`, `\r`, `\n`), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x ### JWT middleware accepts any Authorization scheme, not only Bearer Affects: `hono/jwt`, `hono/jwk`. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474 --- Users who use `app.mount()`, `hono/ip-restriction`, `hono/cookie`, or `hono/jwt`/`hono/jwk` are encouraged to upgrade to this version.