hono

library4.12.14jsnpmunverified

Hono is a lightweight, simple, and ultrafast web framework built entirely on Web Standards, enabling it to run consistently across various JavaScript runtimes including Cloudflare Workers, Fastly Compute, Deno, Bun, Vercel, AWS Lambda, Lambda@Edge, and Node.js. It features a high-performance router (`RegExpRouter`), zero external dependencies, and a small bundle size (under 12kB for `hono/tiny`). Hono emphasizes an excellent developer experience with clean APIs and first-class TypeScript support. The current stable version is 4.12.14, with frequent patch and minor releases addressing bugs, security, and new features. Its key differentiators include true multi-runtime compatibility, focus on Web Standards, and performance, making it an ideal choice for edge-first applications and serverless functions where cold starts and resource usage are critical.

web-framework http-networking devops

npm install hono

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · HONO

hono

web-frameworkjavascriptv4.12.14

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Hono

✓ import { Hono } from 'hono';

✗ const { Hono } = require('hono');

Hono is designed for ESM. While CommonJS might work with transpilers, direct `require` is not the idiomatic or officially supported way, especially for newer versions.

html

✓ import { html } from 'hono/html';

✗ import { html } from 'hono';

Many utilities and middleware are provided as subpath imports to keep the main bundle small and allow for runtime-specific optimizations. Always check the documentation for correct import paths for specific features like JSX helpers (`hono/jsx` or `hono/html`), specific middleware (`hono/logger`, `hono/compress`), or runtime adapters (`hono/cloudflare-workers`).

Context

✓ import type { Context } from 'hono';

✗ import { Context } from 'hono';

TypeScript types like `Context`, `Env`, `Next` are generally imported as type-only imports to avoid bundling them as runtime values and ensure proper tree-shaking and type safety.

This quickstart demonstrates a basic Hono application, showing how to define routes for GET and POST requests, respond with text and JSON, and serve it using `@hono/node-server` for Node.js environments.

import { Hono } from 'hono'; import { serve } from '@hono/node-server'; const app = new Hono(); app.get('/', (c) => { return c.text('Hello Hono!'); }); app.get('/api/data', (c) => { const data = { message: 'This is API data', timestamp: new Date().toISOString() }; return c.json(data); }); app.post('/submit', async (c) => { const body = await c.req.json(); return c.json({ received: body, status: 'success' }, 200); }); console.log('Server running on http://localhost:3000'); serve({ fetch: app.fetch, port: 3000 });

Debug

Known issues

breakingSecurity vulnerability: Improper handling of JSX attribute names in `hono/jsx` SSR could allow malformed attribute keys to corrupt generated HTML output, potentially injecting unintended attributes or elements.

fix

Upgrade Hono to version 4.12.14 or later. Ensure all HTML output from `hono/jsx` SSR is sanitized if user input is directly used in attribute names.

affects: <4.12.14

breakingSecurity vulnerability: Middleware bypass via repeated slashes (`//`) in the `serveStatic` middleware could allow access to protected static files by normalizing paths incorrectly.

fix

Upgrade Hono to version 4.12.12 or later. Review static file serving configurations to ensure robust path validation.

affects: <4.12.12

breakingSecurity vulnerability: Path traversal in `toSSG()` for Static Site Generation allowed writing files outside the intended output directory.

fix

Upgrade Hono to version 4.12.12 or later. Always ensure `toSSG()` output directories are tightly controlled and isolated.

affects: <4.12.12

breakingSecurity vulnerability: Ignoring `__proto__` path segments in `parseBody({ dot: true })` was necessary to prevent potential prototype pollution when merged with unsafe patterns.

fix

Upgrade Hono to version 4.12.7 or later to mitigate prototype pollution risks when parsing request bodies.

affects: <4.12.7

gotchaHono embraces Web Standards, meaning traditional Node.js specific APIs (like `http.IncomingMessage` or `http.ServerResponse`) are abstracted away. When interacting with Node.js, you'll need adapters (e.g., `@hono/node-server`) to bridge the gap.

fix

Use appropriate runtime adapters for your deployment target. For Node.js, install and use `@hono/node-server` to integrate Hono's `fetch` API with the Node.js HTTP server.

affects: >=3.0

gotchaMany features, especially middleware and platform-specific utilities, are distributed as subpath imports (e.g., `hono/logger`, `hono/cloudflare-workers`). Incorrect import paths will lead to `Module not found` errors or unexpected behavior.

fix

Always consult the official Hono documentation for the correct import paths for middleware, JSX utilities, and runtime adapters. Do not assume all features are exported directly from the main `hono` package.

affects: >=3.0

Errors

Common errors & fixes

TypeError: Hono is not a constructor

Attempting to import Hono using CommonJS `require()` syntax in an environment expecting ESM, or when the `package.json` does not correctly specify type `module`.

fix

Ensure your project is configured for ESM by adding `"type": "module"` to your `package.json` or by using `.mjs` file extensions, and always use `import { Hono } from 'hono';`.

Module not found: Error: Can't resolve 'hono/logger'

The specific middleware or utility (e.g., `logger`) is not found at the specified subpath, often due to a typo or an incorrect import path.

fix

Verify the exact import path from Hono's official documentation. For example, `logger` is imported from `hono/logger` (or `hono/logger/deno` for Deno).

Unhandled Promise Rejection: TypeError: Cannot read properties of undefined (reading 'text')

This often occurs when the `c` (Context) object is not correctly passed or is undefined within a handler, or when attempting to use a method like `c.text()` on a non-Context object.

fix

Ensure your route handlers are correctly defined as `(c) => ...` and that `c` is the first argument, representing the Hono Context object. Verify you are not accidentally shadowing `c` or calling `c.text()` outside a valid handler scope.

Upgrade

Version history

4.12.14latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

47 hits · last 30 days

node

Resources

githubhttps://github.com/honojs/hono ↗

packagehttps://www.npmjs.com/package/hono ↗

homepagehttps://hono.dev ↗