# Hono v4.12.34

- Product: Hono (https://whatsnew.fyi/product/hono)
- Vendor: Hono
- Date: 2026-08-03
- Version: v4.12.34
- Original notes: https://github.com/honojs/hono/releases/tag/v4.12.34
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.12.34

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix memo() retaining SSR output across requests in hono/jsx, preventing cross-user data disclosure when components read request-scoped values from context
- **security** — Fix ReDoS vulnerability in CORS middleware via Access-Control-Request-Headers header parsing when allowHeaders is not configured
- **security** — Fix algorithmic complexity DoS in Language Middleware caused by quadratic string processing in language-tag normalization
- **security** — Fix Proxy Helper not removing response headers listed in the Connection header, preventing exposure of connection-scoped metadata to clients

##### Security fixes

This release includes fixes for the following security issues:

###### `memo()` retains SSR output across requests, leading to cross-user data disclosure

Affects: `hono/jsx` (server-side rendering). Fixes `memo()` reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — `useContext()`, `useRequestContext()`, or `getContext()` — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

###### ReDoS in CORS middleware via `Access-Control-Request-Headers`

Affects: `hono/cors`. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the `Access-Control-Request-Headers` preflight header when `allowHeaders` is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

###### Algorithmic complexity DoS in Language Middleware

Affects: `hono/language`. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or `Accept-Language` header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

###### Proxy Helper does not remove response headers listed in the `Connection` header

Affects: `hono/proxy`. Fixes `proxy()` forwarding response headers that the origin's `Connection` header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use `hono/jsx` for server-side rendering, `hono/cors`, `hono/language`, or `hono/proxy` are strongly encouraged to upgrade to this version.