p PatchFirst

CVE-2026-59896

CVE-2026-59896 · hono/jsx does not isolate context per request, leading to cross-request data disclosure

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • hono

    Versions
    • >= 4.11.8, < 4.12.27: Affected

    No fix published

  • hono npm

    Affected ranges
    • SEMVER: ≥ 4.11.8, < 4.12.27

    Update to 4.12.27

Original sources

Check your server →