v4.12.27

xlmnxp/blue-recorderv4.12.27Jun 23, 2026by yusukebe

AI Summary

This security-focused release addresses critical vulnerabilities in Hono's SSR context isolation, JSX escaping bypass, and API Gateway adapter header handling. All issues are rated as high severity.

Key Highlights

Fixed cross-request context isolation in SSR
Resolved Server-Side XSS via JSX escaping bypass
Fixed API Gateway v1 adapter header de-duplication
All vulnerabilities are security-related

New Features

Security fixes for SSR context isolation
XSS vulnerability patch
Header handling improvements for API Gateway adapters

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### hono/jsx does not isolate context per request

Affects: `hono/jsx`, `hono/jsx-renderer`. During SSR, context was stored process-wide instead of per request, so `useContext()`/`useRequestContext()` read after an `await` in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

### Server-Side XSS via JSX escaping bypass in cx()

Affects: `hono/css`. `cx()` marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX `class` attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

### API Gateway v1 adapter can drop a repeated request header value

Affects: `hono/aws-lambda`. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. `203.0.113.1` dropped when `203.0.113.10` is present) — affecting logic such as `X-Forwarded-For`-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of `hono/jsx`/`hono/jsx-renderer`, `hono/css` (`cx()`), or the `hono/aws-lambda` API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.