# Hono v4.13.5

- Product: Hono (https://whatsnew.fyi/product/hono)
- Vendor: Hono
- Date: 2026-08-26
- Version: v4.13.5
- Original notes: https://github.com/honojs/hono/releases/tag/v4.13.5
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.13.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix query parser reading parameters after the URL fragment, which could cause cache-key and proxy interpretation differentials in Cache Middleware and applications behind a proxy, WAF, or logging layer
- **security** — Fix path normalization gap in toSSG() where consecutive parent-directory segments in ssgParams values were not fully collapsed, allowing files to be written outside the output directory
- **security** — Fix unbounded dot-notation nesting in parseBody() that could cause memory exhaustion through disproportionately large object graph allocation

##### Security fixes

This release includes fixes for the following security issues:

###### Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a `?` after a `#` was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

###### Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Affects: `toSSG()` for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in `ssgParams` values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

###### Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Affects: `parseBody()` when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use `parseBody({ dot: true })` are strongly encouraged to upgrade to this version.