# Hono v4.13.7

- Product: Hono (https://whatsnew.fyi/product/hono)
- Vendor: Hono
- Date: 2026-09-04
- Version: v4.13.7
- Original notes: https://github.com/honojs/hono/releases/tag/v4.13.7
- Permalink: https://whatsnew.fyi/product/hono/releases/v4.13.7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix missing HTML escaping for plain strings in Suspense, ErrorBoundary, and Context.Provider components in hono/jsx, and in renderToString() and renderToReadableStream() functions in hono/jsx/dom/server to prevent XSS attacks (GHSA-hxh3-vqpv-xpqv)

##### Security fixes

This release includes a fix for the following security issue:

###### `hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Affects: `Suspense`, `ErrorBoundary`, and `Context.Provider` in `hono/jsx`, and `renderToString()` / `renderToReadableStream()` in `hono/jsx/dom/server`. Fixes missing HTML escaping for a plain string placed directly as a child or `fallback` of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside `Suspense`, `ErrorBoundary`, or `Context.Provider`, or pass them directly to `hono/jsx/dom/server`, are strongly encouraged to upgrade to this version.