# Hono v4.12.27

- Product: Hono (https://whatsnew.fyi/product/hono)
- Vendor: Hono
- Date: 2026-06-23
- Version: v4.12.27
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.27
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.27

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix hono/jsx and hono/jsx-renderer context isolation during SSR to prevent useContext()/useRequestContext() from reading another concurrent request's context value after an await in an async component
- **security** — Fix Server-Side XSS vulnerability in hono/css cx() function by properly escaping untrusted input passed as class names
- **security** — Fix hono/aws-lambda API Gateway v1 and VPC Lattice adapter to correctly match repeated header values by exact match instead of substring matching

##### Security fixes

This release includes fixes for the following security issues:

###### hono/jsx does not isolate context per request

Affects: `hono/jsx`, `hono/jsx-renderer`. During SSR, context was stored process-wide instead of per request, so `useContext()`/`useRequestContext()` read after an `await` in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

###### Server-Side XSS via JSX escaping bypass in cx()

Affects: `hono/css`. `cx()` marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX `class` attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

###### API Gateway v1 adapter can drop a repeated request header value

Affects: `hono/aws-lambda`. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. `203.0.113.1` dropped when `203.0.113.10` is present) — affecting logic such as `X-Forwarded-For`-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of `hono/jsx`/`hono/jsx-renderer`, `hono/css` (`cx()`), or the `hono/aws-lambda` API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.