{"id":10394,"library":"hono","title":"Hono: Ultrafast Web Framework","description":"Hono is a lightweight, simple, and ultrafast web framework built entirely on Web Standards, enabling it to run consistently across various JavaScript runtimes including Cloudflare Workers, Fastly Compute, Deno, Bun, Vercel, AWS Lambda, Lambda@Edge, and Node.js. It features a high-performance router (`RegExpRouter`), zero external dependencies, and a small bundle size (under 12kB for `hono/tiny`). Hono emphasizes an excellent developer experience with clean APIs and first-class TypeScript support. The current stable version is 4.12.14, with frequent patch and minor releases addressing bugs, security, and new features. Its key differentiators include true multi-runtime compatibility, focus on Web Standards, and performance, making it an ideal choice for edge-first applications and serverless functions where cold starts and resource usage are critical.","status":"active","version":"4.12.14","language":"javascript","source_language":"en","source_url":"https://github.com/honojs/hono","tags":["javascript","hono","web","app","http","application","framework","router","cloudflare","typescript"],"install":[{"cmd":"npm install hono","lang":"bash","label":"npm"},{"cmd":"yarn add hono","lang":"bash","label":"yarn"},{"cmd":"pnpm add hono","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"Hono is designed for ESM. While CommonJS might work with transpilers, direct `require` is not the idiomatic or officially supported way, especially for newer versions.","wrong":"const { Hono } = require('hono');","symbol":"Hono","correct":"import { Hono } from 'hono';"},{"note":"Many utilities and middleware are provided as subpath imports to keep the main bundle small and allow for runtime-specific optimizations. Always check the documentation for correct import paths for specific features like JSX helpers (`hono/jsx` or `hono/html`), specific middleware (`hono/logger`, `hono/compress`), or runtime adapters (`hono/cloudflare-workers`).","wrong":"import { html } from 'hono';","symbol":"html","correct":"import { html } from 'hono/html';"},{"note":"TypeScript types like `Context`, `Env`, `Next` are generally imported as type-only imports to avoid bundling them as runtime values and ensure proper tree-shaking and type safety.","wrong":"import { Context } from 'hono';","symbol":"Context","correct":"import type { Context } from 'hono';"}],"quickstart":{"code":"import { Hono } from 'hono';\nimport { serve } from '@hono/node-server';\n\nconst app = new Hono();\n\napp.get('/', (c) => {\n  return c.text('Hello Hono!');\n});\n\napp.get('/api/data', (c) => {\n  const data = { message: 'This is API data', timestamp: new Date().toISOString() };\n  return c.json(data);\n});\n\napp.post('/submit', async (c) => {\n  const body = await c.req.json();\n  return c.json({ received: body, status: 'success' }, 200);\n});\n\nconsole.log('Server running on http://localhost:3000');\nserve({ fetch: app.fetch, port: 3000 });\n","lang":"typescript","description":"This quickstart demonstrates a basic Hono application, showing how to define routes for GET and POST requests, respond with text and JSON, and serve it using `@hono/node-server` for Node.js environments."},"warnings":[{"fix":"Upgrade Hono to version 4.12.14 or later. Ensure all HTML output from `hono/jsx` SSR is sanitized if user input is directly used in attribute names.","message":"Security vulnerability: Improper handling of JSX attribute names in `hono/jsx` SSR could allow malformed attribute keys to corrupt generated HTML output, potentially injecting unintended attributes or elements.","severity":"breaking","affected_versions":"<4.12.14"},{"fix":"Upgrade Hono to version 4.12.12 or later. Review static file serving configurations to ensure robust path validation.","message":"Security vulnerability: Middleware bypass via repeated slashes (`//`) in the `serveStatic` middleware could allow access to protected static files by normalizing paths incorrectly.","severity":"breaking","affected_versions":"<4.12.12"},{"fix":"Upgrade Hono to version 4.12.12 or later. Always ensure `toSSG()` output directories are tightly controlled and isolated.","message":"Security vulnerability: Path traversal in `toSSG()` for Static Site Generation allowed writing files outside the intended output directory.","severity":"breaking","affected_versions":"<4.12.12"},{"fix":"Upgrade Hono to version 4.12.7 or later to mitigate prototype pollution risks when parsing request bodies.","message":"Security vulnerability: Ignoring `__proto__` path segments in `parseBody({ dot: true })` was necessary to prevent potential prototype pollution when merged with unsafe patterns.","severity":"breaking","affected_versions":"<4.12.7"},{"fix":"Use appropriate runtime adapters for your deployment target. For Node.js, install and use `@hono/node-server` to integrate Hono's `fetch` API with the Node.js HTTP server.","message":"Hono embraces Web Standards, meaning traditional Node.js specific APIs (like `http.IncomingMessage` or `http.ServerResponse`) are abstracted away. When interacting with Node.js, you'll need adapters (e.g., `@hono/node-server`) to bridge the gap.","severity":"gotcha","affected_versions":">=3.0"},{"fix":"Always consult the official Hono documentation for the correct import paths for middleware, JSX utilities, and runtime adapters. Do not assume all features are exported directly from the main `hono` package.","message":"Many features, especially middleware and platform-specific utilities, are distributed as subpath imports (e.g., `hono/logger`, `hono/cloudflare-workers`). Incorrect import paths will lead to `Module not found` errors or unexpected behavior.","severity":"gotcha","affected_versions":">=3.0"}],"env_vars":null,"search_vec":"'12kb':59 '4.12.14':82 'across':24 'address':89 'api':70 'app':134 'applic':119,136 'aw':36 'bug':90 'built':14 'bun':34 'bundl':56 'choic':114 'class':74 'clean':69 'cloudflar':29,139 'cold':124 'compat':103 'comput':32 'consist':23 'critic':130 'current':78 'deno':33 'depend':52 'develop':66 'differenti':97 'edg':39,117 'edge-first':116 'emphas':63 'enabl':19 'entir':15 'excel':65 'experi':67 'extern':51 'fast':31 'featur':43,94 'first':73,118 'first-class':72 'focus':104 'framework':4,13,137 'frequent':84 'function':122 'high':46 'high-perform':45 'hono':1,5,62,132 'hono/tiny':61 'http':135 'ideal':113 'includ':28,98 'javascript':26,131 'key':96 'lambda':37,38 'lightweight':8 'make':110 'minor':87 'multi':101 'multi-runtim':100 'new':93 'node.js':41 'patch':85 'perform':47,109 'regexprout':49 'releas':88 'resourc':127 'router':48,138 'run':22 'runtim':27,102 'secur':91 'serverless':121 'simpl':9 'size':57 'small':55 'stabl':79 'standard':18,107 'start':125 'support':76 'true':99 'typescript':75,140 'ultrafast':2,11 'usag':128 'various':25 'vercel':35 'version':80 'web':3,12,17,106,133 'worker':30 'zero':50","created_at":"2026-04-18T08:58:35.969046+00:00","updated_at":"2026-04-19T05:46:53.402716+00:00","problems":[{"fix":"Ensure your project is configured for ESM by adding `\"type\": \"module\"` to your `package.json` or by using `.mjs` file extensions, and always use `import { Hono } from 'hono';`.","cause":"Attempting to import Hono using CommonJS `require()` syntax in an environment expecting ESM, or when the `package.json` does not correctly specify type `module`.","error":"TypeError: Hono is not a constructor"},{"fix":"Verify the exact import path from Hono's official documentation. For example, `logger` is imported from `hono/logger` (or `hono/logger/deno` for Deno).","cause":"The specific middleware or utility (e.g., `logger`) is not found at the specified subpath, often due to a typo or an incorrect import path.","error":"Module not found: Error: Can't resolve 'hono/logger'"},{"fix":"Ensure your route handlers are correctly defined as `(c) => ...` and that `c` is the first argument, representing the Hono Context object. Verify you are not accidentally shadowing `c` or calling `c.text()` outside a valid handler scope.","cause":"This often occurs when the `c` (Context) object is not correctly passed or is undefined within a handler, or when attempting to use a method like `c.text()` on a non-Context object.","error":"Unhandled Promise Rejection: TypeError: Cannot read properties of undefined (reading 'text')"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"","cli_version":null,"type":"library","homepage":"https://hono.dev","github":"https://github.com/honojs/hono","docs":null,"changelog":null,"pypi":null,"npm":"https://www.npmjs.com/package/hono","openapi_spec":null,"status_page":null,"smithery":null,"categories":["web-framework","http-networking","devops"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-17","next_check":"2026-07-18","install_tag":null}}