Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-59896

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Description

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

honojs hono

  • >= 4.11.8, < 4.12.27affected

References