# Hono release history: 42 security advisories in 2026

Source page: https://dev-news.anonyfox.com/hono/

Every Hono 4 release from npm as a stack of cells per minor line, the 2026 run of security fixes that dominates it, the adapter split in 4.13.10 and the first v5 release candidates.

## Where it stands (2026-10-24)

Hono has published 42 security advisories in 2026, spread over 15 releases. In 2024 and 2025 together it published five. Most of this year's landed on 4.12, which took 35 releases between February and August, ten of them security fixes. The latest, 4.13.11 on 29 September, fixed serveStatic decoding a request path twice, so a crafted URL could be routed as one path, served as another, and skip middleware on a static prefix.

A day earlier 4.13.10 moved the runtime adapters into their own packages, such as @hono/bun and @hono/cloudflare-workers, and deprecated the hono/<adapter> imports for removal in v5. hono/cloudflare-pages was deprecated with no replacement. 5.0.0-rc.0 and rc.1 followed on 8 and 10 October, both published without release notes.

## Latest stable releases

- [4.13.13](https://github.com/honojs/hono/releases/tag/v4.13.13) (2026-10-04): app.mount('/itty-router', ittyRouter.handle)
- [4.13.12](https://github.com/honojs/hono/releases/tag/v4.13.12) (2026-09-30): fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in https://github.com/honojs/hono/pull/5485
- [4.13.11](https://github.com/honojs/hono/releases/tag/v4.13.11) (2026-09-29)
- [4.13.10](https://github.com/honojs/hono/releases/tag/v4.13.10) (2026-09-28): import { serveStatic } from 'hono/bun'
- [4.13.9](https://github.com/honojs/hono/releases/tag/v4.13.9) (2026-09-24): fix(jsx): replace Suspense and ErrorBoundary content across newlines in https://github.com/honojs/hono/pull/5380
- [4.13.8](https://github.com/honojs/hono/releases/tag/v4.13.8) (2026-09-15): docs: fix typos in code comments and link third-party middleware section in https://github.com/honojs/hono/pull/5343
- [4.13.7](https://github.com/honojs/hono/releases/tag/v4.13.7) (2026-09-04)
- [4.13.6](https://github.com/honojs/hono/releases/tag/v4.13.6) (2026-09-04): fix(client): keep a param value of "index" in $url() and $path() in https://github.com/honojs/hono/pull/5297
- [4.13.5](https://github.com/honojs/hono/releases/tag/v4.13.5) (2026-08-26)
- [4.13.4](https://github.com/honojs/hono/releases/tag/v4.13.4) (2026-08-24): fix(request): handle params on unmatched requests in https://github.com/honojs/hono/pull/5268
- [4.13.3](https://github.com/honojs/hono/releases/tag/v4.13.3) (2026-08-18): fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in https://github.com/honojs/hono/pull/5227
- [4.13.2](https://github.com/honojs/hono/releases/tag/v4.13.2) (2026-08-13): fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in https://github.com/honojs/hono/pull/5197
- [4.13.1](https://github.com/honojs/hono/releases/tag/v4.13.1) (2026-08-07): fix(trie-router): count every slash a pattern consumes by @Jaybhade in https://github.com/honojs/hono/pull/5189
- [4.13.0](https://github.com/honojs/hono/releases/tag/v4.13.0) (2026-08-03): perf(context): iterate the header record with for..in https://github.com/honojs/hono/pull/5118
- [4.12.34](https://github.com/honojs/hono/releases/tag/v4.12.34) (2026-08-03)

Releases since 2024: 209 stable, 12 prereleases. JSON: https://dev-news.anonyfox.com/hono.json. Feed: https://dev-news.anonyfox.com/hono/feed.xml