Starstruk Logo MarkStarstruk

v4.9.6

honojs/honov4.9.6Sep 3, 2025by yusukebe

AI Summary

This is a critical security patch release addressing a vulnerability in URL path parsing (`getPath`) that could cause path confusion with malformed requests. Users relying on reverse proxies like Nginx for ACLs or endpoint restrictions should update immediately. The release contains only minor maintenance updates to router benchmarks.

Key Highlights

  • Critical security fix for URL path parsing vulnerability (GHSA-9hp6-4448-45g2)
  • Path confusion issue fixed in getPath function for malformed requests
  • Updated router benchmark packages
  • Removed commented-out code from router benchmarks

Full Release Notes

## Security

Fixed a bug in URL path parsing (`getPath`) that could cause path confusion under malformed requests.

If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like `/admin`, please update immediately.

See advisory for details: GHSA-9hp6-4448-45g2

## What's Changed
* chore: update packages in the router bench by @yusukebe in https://github.com/honojs/hono/pull/4386
* chore(benchmarks): remove comment-out from router bench by @yusukebe in https://github.com/honojs/hono/pull/4387


**Full Changelog**: https://github.com/honojs/hono/compare/v4.9.5...v4.9.6