chore(deps): update dependency hono to v4.12.21 [security]#432
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency hono to v4.12.21 [security]#432renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
|
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #432 +/- ##
=======================================
Coverage 85.66% 85.66%
=======================================
Files 61 61
Lines 1109 1109
Branches 235 235
=======================================
Hits 950 950
Misses 159 159 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.12.18→4.12.21Hono: JWT middleware accepts any Authorization scheme, not only Bearer
CVE-2026-47673 / GHSA-f577-qrjj-4474
More information
Details
Summary
The
jwtandjwkmiddlewares do not verify that theAuthorizationheader value uses theBearerscheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearerscheme identifier (such asBasicorToken) is authenticated identically to a correctly formedBearerrequest.Details
When processing an
Authorization(or custom) header, the middleware splits the value on whitespace and uses the second token as the JWT to verify. It does not check that the first token isbearer(case-insensitively). RFC 6750 specifies that JWT bearer tokens must be presented using theBearerscheme; other scheme identifiers carry distinct semantics and may be subject to different policies in network-layer security controls.This discrepancy means that scheme-aware external controls — such as WAF rules, API gateways, or reverse proxies that apply policies specific to the
Bearerscheme identifier — can be bypassed by presenting a valid JWT under a different scheme name.This issue affects
hono/jwtandhono/jwkmiddleware.Impact
An attacker who possesses a valid JWT may present it under a non-
Bearerscheme identifier and still pass middleware authentication.This may lead to:
This issue affects applications where
hono/jwtorhono/jwkauthentication is combined with external controls that enforce scheme-based access policies.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/hono (hono)
v4.12.21Compare Source
Security fixes
This release includes fixes for the following security issues:
app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Affects:
app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3IP Restriction bypasses static deny rules for non-canonical IPv6
Affects:
hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Affects:
hono/cookie. Fixes missing validation ofsameSiteandpriorityoptions against injection characters (;,\r,\n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5xJWT middleware accepts any Authorization scheme, not only Bearer
Affects:
hono/jwt,hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474Users who use
app.mount(),hono/ip-restriction,hono/cookie, orhono/jwt/hono/jwkare encouraged to upgrade to this version.v4.12.20Compare Source
What's Changed
New Contributors
Full Changelog: honojs/hono@v4.12.19...v4.12.20
v4.12.19Compare Source
What's Changed
bytes()by @yusukebe in #4921@hono/node-serverto v2 and fix abort handling by @yusukebe in #4940New Contributors
Full Changelog: honojs/hono@v4.12.18...v4.12.19
Configuration
📅 Schedule: (in timezone Europe/Stockholm)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.