Hono 4.13.16 Fixes 5 Security Bugs, Prisma 8 RC.22

Executive Summary

• Hono 4.13.16 (Nov 1) fixes five advisories: a middleware bypass through mount(), skipped wildcard middleware in RegExpRouter, skipped multipart validation, HTML injection in the css helper, and a csrf() gap for text/ping requests. Four are rated Moderate and one Low. See the release notes.
• NestJS 12.3.0 adds a native Node HTTP platform adapter and bumps multer to 2.5.0 under a security tag (notes).
• Prisma ORM 8.0.0-rc.22 changes the meaning of Postgres DateTime, Date and Time types, and rc.21 makes client calls reject instead of throw (rc.22). This is a release candidate, so keep it out of production.
• Reminder: Next.js has announced a security release for Tuesday, November 3 covering seven medium-severity issues (advance notice). Reserve a deploy window.

Hono 4.13.16: Five Advisories Fixed

Hono shipped 4.13.15 (WWW-Authenticate realm backslash escaping and a c.header() fix) and then 4.13.16 on Nov 1. The second release carries the security fixes, published on the project's advisory page. The advisory list shows no CVE IDs or version ranges yet, so open each advisory for the details.

• GHSA-4m76-xfj5-7975 (Moderate): mount() and app.mount() could forward a path that skipped middleware scoped inside the mount prefix. Dynamic prefixes were stripped by the wrong length. Routes such as /assets* and duplicate parameter names now throw.
• GHSA-h7mg-cq63-vhpq (Moderate): RegExpRouter, which includes the default SmartRouter, skipped wildcard middleware for some patterns and for paths with encoded line terminators. Custom patterns that can match an empty string now throw UnsupportedPathError, and PreparedRegExpRouter data must be regenerated.
• GHSA-4h7h-rv7c-7m2v (Moderate): validator('form') skipped validation for multipart/form-data requests with an extra parameter such as charset.
• GHSA-46wx-v44x-9hh2 (Moderate): csrf() did not check POSTs sent through hyperlink auditing (text/ping), so the Origin and Sec-Fetch-Site checks were bypassed.
• GHSA-3gg2-335m-rxc6 (Low): the css helper did not escape a closing style tag assembled from template parts and values, allowing HTML injection. Closing tags are now escaped after minification.

The same release also tightens JWT parsing: signature segments outside the base64url alphabet and headers containing crit are now rejected (#5597). Upgrade, then check whether your routing relies on any pattern that now throws:

npm install [email protected]
npm ls hono

# If you use PreparedRegExpRouter, regenerate its prepared data after upgrading.
# Boot your app once in staging: invalid patterns now throw at registration time.

import { Hono } from 'hono'

const api = new Hono()
const app = new Hono()

// Prefer a static mount prefix. Dynamic prefixes and patterns like '/assets*'
// now throw in 4.13.16 instead of silently mis-scoping middleware.
app.route('/api', api)
app.mount('/legacy', legacyHandler)

NestJS 12.3.0 and Recent 12.x Behavior Changes

NestJS 12.3.0 (Oct 27) adds a native Node HTTP platform adapter (#18063), fixes across core, common, microservices, Express and Fastify, and a dependency update to multer 2.5.0 that the notes tag as security (#18268). Patches 12.3.1 and 12.3.2 followed the same day; the 12.3.2 page lists no notes. If you jumped to 12.x recently, review the defaults changed in 12.2.0: ValidationPipe now defaults to validationError.target: false, FileTypeValidator string matching is stricter, MQTT reconnectOnConnackError is on by default, and fieldNestingDepth and fieldArrayIndexLimit default to 32 and 1000.

npm install @nestjs/[email protected] @nestjs/[email protected] @nestjs/[email protected]
npm ls multer   # expect 2.5.0 or later

Prisma ORM 8.0.0-rc.21 and rc.22: Breaking Changes in the RC Line

rc.22 (Oct 30) makes DateTime, Date, Time and the new Duration convenience types on PostgreSQL that accept JavaScript dates or strings. To keep the previous Temporal-based types, rename them to TimestamptzTemporal, DateTemporal and TimeTemporal. Contracts can also declare Postgres extensions such as pgvector, PostGIS, ParadeDB and citext, and MongoDB helpers now take { context }. rc.21 makes client methods reject instead of throwing at the call, so errors are only caught if you await inside try/catch. It also adds enum value rename and delete support on Postgres and SQLite, and the first public MySQL packages. The release pages truncate the full breaking-change lists, so read them before testing.

// rc.21+: errors surface as rejections, so await inside try/catch
try {
  const user = await client.users.findFirst({ where: { id } })
} catch (err) {
  // handle here; a bare non-awaited call will no longer throw synchronously
}

Carry-Over and Scope Note

Still open if unpatched: the Oct 21 Node.js security releases (26.12.1, 24.22.1, 22.23.4). Next.js stable remains 16.4.3 with 16.5.0 canaries still shipping daily (npm). Today's verified activity was Hono, plus NestJS and Prisma from the past week; I did not find verifiable new stable releases for the remaining tools on the list, so none are claimed.

Action Items

1. Upgrade Hono to 4.13.16 and test startup for patterns that now throw.
2. Confirm NestJS apps resolve multer 2.5.0 or later.
3. Keep Prisma 8 RC builds in a branch until the stable release.
4. Plan the Nov 3 Next.js security update.