CVE-2026-71850: CWE-488: Exposure of Data Element to Wrong Session in honojs hono
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.
AI Analysis
Technical Summary
Hono versions >=3.8.0 and <4.12.34 contain a vulnerability where the memo() function from hono/jsx caches server-side rendered HTML based solely on component props, ignoring request-scoped values like JSX Context and request context hooks. As a result, cached HTML from one user's request can be reused for another user with identical props, potentially exposing sensitive data such as user account information, request-scoped secrets like CSRF tokens, or role-specific content. The cached result lives as long as the memoized component, outliving the original request. This vulnerability is tracked as CVE-2026-71850 and is fixed in version 4.12.34.
Potential Impact
An attacker or user may receive HTML content rendered for another user's session, leading to exposure of sensitive data including account or profile information, request-scoped secrets embedded in HTML (e.g., CSRF tokens), and role-specific content that should not be accessible. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Upgrade hono to version 4.12.34 or later, where this issue is fixed. There is no official patch or temporary workaround documented. Until upgrading, avoid using memo() in server-side rendering contexts where request-scoped data is accessed, or ensure that memoized components do not rely on request-scoped values.
CVE-2026-71850: CWE-488: Exposure of Data Element to Wrong Session in honojs hono
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.
CVSS v3.1
Score 4.8medium
Affected software
honojs
hono
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Hono versions >=3.8.0 and <4.12.34 contain a vulnerability where the memo() function from hono/jsx caches server-side rendered HTML based solely on component props, ignoring request-scoped values like JSX Context and request context hooks. As a result, cached HTML from one user's request can be reused for another user with identical props, potentially exposing sensitive data such as user account information, request-scoped secrets like CSRF tokens, or role-specific content. The cached result lives as long as the memoized component, outliving the original request. This vulnerability is tracked as CVE-2026-71850 and is fixed in version 4.12.34.
Potential Impact
An attacker or user may receive HTML content rendered for another user's session, leading to exposure of sensitive data including account or profile information, request-scoped secrets embedded in HTML (e.g., CSRF tokens), and role-specific content that should not be accessible. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Upgrade hono to version 4.12.34 or later, where this issue is fixed. There is no official patch or temporary workaround documented. Until upgrading, avoid using memo() in server-side rendering contexts where request-scoped data is accessed, or ensure that memoized components do not rely on request-scoped values.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-07T18:26:53.523Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a762a7bbf8831d539f90c03
Added to database: 08/07/2026, 18:56:59 UTC
Last enriched: 08/15/2026, 15:34:06 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.