Executive brief
A vulnerability in the Hono web framework could cause a user to see another person's private information. This happens because the system incorrectly saves and reuses parts of a webpage that were originally created for a different user. As a result, sensitive data like account details or security tokens could be accidentally shown to the wrong person.
Technical details
The `memo()` function in `hono/jsx` implements a caching mechanism that compares components based solely on their props. However, it fails to account for request-scoped ambient context (such as JSX Context, `useRequestContext`, or `getContext`) during this comparison. If a memoized component reads user-specific data from the context rather than through props, the rendered HTML from a previous request may be served to a subsequent user if the props match. This leads to a session leakage vulnerability (CWE-488) where sensitive data like CSRF tokens or profile information is disclosed across requests on the same warm instance. The issue is fixed in version 4.12.34.
Affected products
- honojs hono >= 3.8.0, < 4.12.34
Timeline
- 2026-08-03: patched: Fix released in version 4.12.34
- 2026-08-07: advisory: GitHub Advisory published