CVE-2026-71850: Hono Information Disclosure Vulnerability

CVE-2026-71850 Overview

CVE-2026-71850 affects Hono, a web application framework supporting multiple JavaScript runtimes. The vulnerability exists in the memo() function from hono/jsx in versions 3.8.0 through 4.12.33. The function retains server-side rendered output and reuses it across requests when props compare as equal. Request-scoped values read implicitly during rendering do not participate in the memoization comparison. As a result, a user can receive HTML rendered for another user's request on the same warm instance. This issue falls under [CWE-488] Exposure of Data Element to Wrong Session. Version 4.12.34 fixes the vulnerability.

Critical Impact
Cross-request response contamination can disclose another user's account data, CSRF tokens, or role-specific content to unauthorized users.

Affected Products

Hono web framework versions 3.8.0 through 4.12.33
Applications using memo() from hono/jsx
Applications relying on createContext(), useContext(), useRequestContext(), or getContext() within memoized components

Discovery Timeline

2026-08-07 - CVE-2026-71850 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71850

Vulnerability Analysis

Hono's memo() higher-order component caches the rendered output of a JSX component based on prop equality. The cache lives as long as the wrapped component instance, which persists across requests on warm runtime instances. When two requests render the same memoized component with equal props, the second request receives the cached HTML from the first request.

The defect arises because memo() compares only the explicit props passed to the component. Values read implicitly through JSX Context APIs, useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage are never included in the equality check. These APIs commonly carry request-scoped data such as the current user, session identifiers, CSRF tokens, and role information.

Exploitation requires user interaction and a shared warm instance, which is common in serverless and long-running Node.js deployments. Confidentiality impact is high because rendered HTML may embed authenticated user data. Integrity and availability are unaffected.

Root Cause

The memo() implementation treats components as pure functions of their props. It does not account for side channel inputs consumed inside the component body through context lookups. The retained result outlives the request that produced it.

Attack Vector

An attacker triggers a request that renders a memoized component. A legitimate user subsequently issues a request that resolves to the same component with matching props on the same runtime instance. The legitimate user receives HTML containing data intended for the attacker, or vice versa, disclosing account content, tokens, or role-gated markup. Refer to the Hono GitHub Security Advisory for the maintainers' technical description.

Detection Methods for CVE-2026-71850

Indicators of Compromise

User reports of receiving HTML content, profile data, or dashboard elements belonging to other users
Application logs showing consistent response payload hashes across distinct authenticated sessions
CSRF token mismatches or session validation failures triggered by tokens rendered for a different user

Detection Strategies

Perform a source code audit for imports of memo from hono/jsx and inspect wrapped components for context consumption via useContext(), useRequestContext(), or getContext()
Deploy synthetic traffic that alternates between authenticated identities to verify response isolation across concurrent requests
Compare response body checksums against expected per-user rendering to identify cached leakage on warm instances

Monitoring Recommendations

Log the resolved user identity alongside response body hashes for pages that render memoized components
Alert on repeated identical response bodies served to distinct session identifiers within short time windows
Track Hono runtime version inventory across deployments to detect vulnerable instances

How to Mitigate CVE-2026-71850

Immediate Actions Required

Upgrade Hono to version 4.12.34 or later across all deployments
Audit application code for memo() usage that relies on request-scoped context values
Rotate any CSRF tokens, session secrets, or credentials that may have been rendered inside memoized components and exposed to unintended users

Patch Information

The maintainers fixed the issue in Hono 4.12.34. Upgrade using npm install hono@4.12.34 or the equivalent command for your package manager. Full technical details are available in the Hono GitHub Security Advisory GHSA-f23p-vx2j-j53r.

Workarounds

Remove memo() wrappers from components that read request-scoped context until the upgrade is applied
Pass all request-scoped values explicitly as props so they participate in the memo() comparator
Restart or recycle serverless and Node.js instances frequently to reduce the window during which cached renders persist

bash

# Upgrade Hono to the patched release
npm install hono@4.12.34

# Verify installed version
npm ls hono