{"id":"EUVD-2026-42326","enisaUuid":"721c894b-5f6c-3805-a08d-95f2599ae693","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.","datePublished":"Jul 8, 2026, 4:08:07 PM","dateUpdated":"Jul 8, 2026, 4:59:09 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj\nhttps://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f\nhttps://github.com/honojs/hono/releases/tag/v4.12.27\n","aliases":"CVE-2026-59896\nGHSA-hvrm-45r6-mjfj\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"2adff952-7e86-30ea-a752-66d9e5d89ba4","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.11.8, \u003c 4.12.27"}],"enisaIdVendor":[{"id":"d84dee04-2c8d-3148-b05c-87a84badcb9f","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"492bf12f-fd42-3670-9fbe-688fe5411e64","vulnerability":{"id":"GHSA-hvrm-45r6-mjfj","description":"hono/jsx does not isolate context per request, leading to cross-request data disclosure","datePublished":"Jul 21, 2026, 6:34:19 PM","dateUpdated":"Jul 21, 2026, 6:34:19 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59896\nhttps://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f\nhttps://github.com/honojs/hono\nhttps://github.com/honojs/hono/releases/tag/v4.12.27\n","enisa_id":"EUVD-2026-42326\n","aliases":"GHSA-hvrm-45r6-mjfj\nCVE-2026-59896\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"65defff8-e794-325a-8b77-59b8713d35c3","vulnerability":{"id":"CVE-2026-59896","description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.","datePublished":"Jul 8, 2026, 4:08:07 PM","dateUpdated":"Jul 8, 2026, 4:59:09 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj\nhttps://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f\nhttps://github.com/honojs/hono/releases/tag/v4.12.27\n","enisa_id":"EUVD-2026-42326\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"c0e1e59d-9d57-33fc-83d5-d47659412957","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"4.11.8, \u003c 4.12.27"}],"vulnerabilityVendor":[{"id":"1c02e186-5b23-3c56-9fe2-df187ab0b3d5","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}