chore(deps): Update dependency hono to ^4.12.34 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	^4.12.31 → ^4.12.34

---

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207 / GHSA-8j4g-w8fx-2239

More information

Details

Summary

The built-in CORS middleware (hono/cors) parses the attacker-controlled Access-Control-Request-Headers request header during a preflight (OPTIONS) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.

Details

On a CORS preflight, when allowHeaders is not configured - the default - the middleware reflects and parses the Access-Control-Request-Headers value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n²)) with the length of the value when it contains a long whitespace sequence without a delimiter.

Because the header value is bounded only by the deployment's maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.

This issue arises for any application using cors() with the default (or an empty) allowHeaders. Applications that set a non-empty allowHeaders do not reach the affected path.

Impact

An unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
• https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
• https://github.com/honojs/hono/releases/tag/v4.12.34
• https://github.com/advisories/GHSA-8j4g-w8fx-2239

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.12.34

Compare Source

v4.12.33

Compare Source

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in #​5164
• chore: bump @hono/node-server in #​5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in #​5166
• chore: remove undici in favor of global fetch in #​5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

Compare Source

What's Changed

• ci: enable reports for type & bundle size check in #​5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in #​5142
• fix(sse): emit empty id field to reset Last-Event-ID in #​5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in #​5145
• fix: use Object.create(null) when parsing query, headers, and params in #​5161
• fix(secure-headers): keep CSP callbacks scoped to their header in #​5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.