Quick answers
- Is CVE-2026-71850 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-71850 being exploited in the wild.
- How severe is CVE-2026-71850?
- Medium severity, with a CVSS score of 4.8, published 7 August 2026.
- Which products and versions are affected?
- hono (npm) >= 3.8.0, < 4.12.34, SEMVER:introduced=3.8.0,fixed=4.12.34.
- Is there a fix for CVE-2026-71850?
- Yes. hono (npm): upgrade to 4.12.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-71850 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-71850?
- Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- hono (npm): upgrade to 4.12.34 or later
npm install hono@4.12.34
Technical details
The `memo()` function in `hono/jsx` implements a caching mechanism that compares components based solely on their props. However, it fails to account for request-scoped ambient context (such as JSX Context, `useRequestContext`, or `getContext`) during this comparison. If a memoized component reads user-specific data from the context rather than through props, the rendered HTML from a previous request may be served to a subsequent user if the props match. This leads to a session leakage vulnerability (CWE-488) where sensitive data like CSRF tokens or profile information is disclosed across requests on the same warm instance. The issue is fixed in version 4.12.34.
Affected products
- honojs hono >= 3.8.0, < 4.12.34
Identifiers
- CVE-2026-71850
- GHSA-f23p-vx2j-j53r
Timeline
- 2026-08-03: patched: Fix released in version 4.12.34
- 2026-08-07: advisory: GitHub Advisory published