v4.13.7

honojs/honov4.13.7Sep 4, 2026by yusukebe

AI Summary

This release addresses a critical XSS vulnerability in the `hono/jsx` library where plain strings were rendered unescaped in boundary components and server rendering functions. The update ensures proper HTML escaping for untrusted data within Suspense, ErrorBoundary, Context.Provider, and related server-side rendering methods.

Key Highlights

Security patch for XSS vulnerability (GHSA-hxh3-vqpv-xpqv)
Fix for missing HTML escaping in `Suspense` components
Fix for missing HTML escaping in `ErrorBoundary` components
Fix for missing HTML escaping in `Context.Provider` components
Fix for server rendering functions: `renderToString()` and `renderToReadableStream()`

Full Release Notes

## Security fixes

This release includes a fix for the following security issue:

### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.