Repository navigation
chore(deps): bump hono to 4.13.16 in package-lock.json (5 advisories) #5549
Description
Filed automatically from 5 open Dependabot alerts by the daily alert sweep (#4874). The fix is written by hand against v2/main.
| Package | hono (npm) |
| Manifest | package-lock.json |
Vulnerable on v2/main |
4.13.13 |
| Bump to | 4.13.16: the lowest listed patched version that no range below covers |
| Scope | runtime |
| Highest severity | medium |
Advisories
| GHSA | CVE | Severity | Vulnerable range | Fixed in | Summary |
|---|---|---|---|---|---|
| GHSA-3gg2-335m-rxc6 | CVE-2026-126359 | low | >= 3.12.0, <= 4.13.15 | 4.13.16 | Hono: css helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection |
| GHSA-46wx-v44x-9hh2 | CVE-2026-126355 | medium | < 4.13.16 | 4.13.16 | Hono: csrf() does not check requests sent by hyperlink auditing (text/ping) |
| GHSA-4h7h-rv7c-7m2v | CVE-2026-126356 | medium | >= 4.5.1, <= 4.13.15 | 4.13.16 | Hono: validator('form') skips validation for multipart/form-data requests with extra parameters |
| GHSA-4m76-xfj5-7975 | CVE-2026-126357 | medium | < 4.13.16 | 4.13.16 | Hono: mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix |
| GHSA-h7mg-cq63-vhpq | CVE-2026-126358 | medium | >= 4.1.4, <= 4.13.15 | 4.13.16 | Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator |
Fix
Add an overrides entry in the root package.json pinning hono to >=4.13.16, for the copies below, which no declared range reaches. Not npm audit fix, which can resolve an advisory by silently downgrading.
Then verify before opening the PR: every locked copy must be outside every range in the Advisories table. node scripts/dependabot-alerts.mjs --dry-run against the branch should report this exposure cleared.
| Vulnerable copy | Version |
|---|---|
node_modules/hono |
4.13.13 |
Note
The GHSA, CVE, severity, range and summary are the advisory's own, as Dependabot reports them. What this sweep verified against v2/main is the installed versions and whether each advisory's range still matches them: GitHub computes alerts from the default branch, so an alert is filed only after that re-check.
Activity
shubhro2002 commentedon Nov 14, 2026
I've prepared a lockfile-only fix for this on my fork, bumping
honoto 4.13.16 inpackage-lock.json:shubhro2002@171355c
Since PR creation is limited to collaborators on this repo, I can't open a PR directly. Feel free to cherry-pick the commit, or let me know if you'd like me to submit it another way.