Hono versions 3.8.0 to 4.12.33 contain a vulnerability where the memo() function from hono/jsx caches server-side rendered HTML based solely on comparator-equal props, without considering request-scoped values such as JSX Context or request-specific data. Because the cached result persists beyond the original request, a user may receive HTML containing another user's data, including sensitive information like account details or CSRF tokens. This is due to components wrapped with memo() being compared only by props, while implicit context and request-scoped values do not participate in the comparison. The vulnerability is addressed in version 4.12.34.

An attacker or user may receive HTML responses containing data from another user's session, potentially exposing sensitive information such as account or profile data, request-scoped secrets like CSRF tokens, or role-specific content that should not be accessible. This can lead to privacy violations and unauthorized disclosure of sensitive information. The CVSS score is 4.8 (medium severity), reflecting the network attack vector, required low privileges, and user interaction.

Upgrade to Hono version 4.12.34 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 4.12.34.