Hono v4.12.12 Security Update: Path Traversal, Middleware Bypass, Cookie Validation Issues

Hono v4.12.12 Security Vulnerability Summary Version Information: Hono v4.12.12 Vulnerability Overview and Scope: 1. Serve Static Middleware Bypass via Repeated Slashes in serveStatic Affected Scope: Serve Static middleware Description: Fixed inconsistencies in path normalization to prevent bypassing route-based middleware protection and accessing protected static files via repeated slashes ( ). Fix: Corrected the path normalization logic. 2. Path Traversal in toSSG() Affected Scope: Static Site Generation (toSSG) Description: Fixed a path traversal vulnerability to prevent crafted values from writing files outside the configured output directory. Fix: Patched the path traversal vulnerability. 3. Incorrect IP Matching in ipRestriction() for IPv4-Mapped IPv6 Addresses Affected Scope: IP Restriction Middleware Description: Fixed improper handling of IPv4-mapped IPv6 addresses (e.g., ) to prevent allow/deny rules from being bypassed. Fix: Corrected the IP address matching logic. 4. Missing Cookie Name Validation on Write Path in setCookie() Affected Scope: , , (from ) Description: Fixed the lack of cookie name validation on the write path to prevent inconsistencies between parsing and serialization. Fix: Added validation for cookie names. 5. Non-breaking Space Prefix Bypass in Cookie Name Handling in getCookie() Affected Scope: (from ) Description: Fixed discrepancies in cookie name handling to prevent attacker-controlled cookies from overwriting legitimate cookies and bypassing prefix protection. Fix: Corrected the cookie name handling logic. Remediation: It is strongly recommended that all users utilizing Serve Static, Static Site Generation, Cookie utilities, or IP Restriction middleware upgrade to version v4.12.12**.

Goal Reached Thanks to every supporter — we hit 100%!

Hono v4.12.12 Security Update: Path Traversal, Middleware Bypass, Cookie Validation Issues

More from this source