CVE-2026-71850
Received Received - Intake

Cross-Site Scripting in Hono JSX memo()

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-71850
EUVD
EUVD-2026-54580

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
hono hono From 3.8.0 (inc) to 4.12.33 (inc)
hono hono 4.12.34
honojs hono From 3.8.0 (inc) to 4.12.34 (exc)
honojs hono 4.12.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Hono framework's memo() function in versions 3.8.0 to 4.12.33. It allows server-side rendered HTML output to be reused across different user requests when components wrapped in memo() have identical props. Request-specific data read inside these components is not considered in the comparison, causing HTML from one user's request to be sent to another user.

Detection Guidance

To detect this vulnerability, check if your Hono application uses the memo() function in versions between 3.8.0 and 4.12.33. Review server-side rendering (SSR) components wrapped with memo() that read request-specific data from contexts like JSX Context, useRequestContext(), or getContext(). Verify if multiple users receive responses containing HTML from other users.

Impact Analysis

This vulnerability could lead to sensitive data exposure. Users might receive HTML responses containing another user's account details, profile data, CSRF tokens, or role-specific content. This occurs when two users render the same memoized component with equal props on the same server instance.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive user data to unauthorized parties. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Data leaks through this vulnerability may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Hono to version 4.12.34 or later to patch the vulnerability. Avoid using memo() for components that read request-specific data from ambient contexts. Pass all request-specific data through props instead of relying on implicit context values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart