CVE-2026-71850

Name of the Vulnerable Software and Affected Versions Hono versions 3.8.0 through 4.12.33

Description The memo() function from hono/jsx retains the result of a server-side render and reuses it for subsequent renders when props are equal. Because request-scoped values read inside the component are not included in this comparison, a response may contain HTML rendered for a different user's request. This occurs when components wrapped with memo() read data implicitly during rendering via createContext(), useContext(), useRequestContext() from hono/jsx-renderer, or getContext() from hono/context-storage, rather than receiving that data through props. Consequently, the retained result outlives the request that produced it, potentially leading to the disclosure of another user's account or profile data, request-scoped secrets like CSRF tokens, or role-specific content if both users hit the same warm instance with equal props.

Recommendations Update to version 4.12.34. As a temporary workaround, avoid wrapping components that read ambient request state in the memo() function or ensure all request-specific values are passed explicitly through props.