{"id":"GHSA-hvrm-45r6-mjfj","revision":"bb5adc299d244e61a837cdaa61c57057","records":[{"revision":"bb5adc299d244e61a837cdaa61c57057","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-hvrm-45r6-mjfj","aliases":["CVE-2026-59896"],"title":"hono/jsx does not isolate context per request, leading to cross-request data disclosure","description":"### Summary\n\n`hono/jsx` did not isolate context values per request during server-side rendering. While an async component was suspended on `await`, its provided context value stayed observable to other requests rendering concurrently, so `useContext()` could return a value from a different in-flight request.\n\n### Details\n\nDuring server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.\n\nThis affects the usual ways request-scoped data is passed through a server-rendered JSX tree:\n\n- `createContext()` / `useContext()`\n- the `jsxRenderer` middleware and `useRequestContext()`\n\nIt arises only when context is read after an `await` inside an async component while requests render concurrently. Reading context synchronously (before any `await`), purely synchronous rendering, and client-side (DOM) rendering are not affected.\n\n### Impact\n\nUnder concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an `await` may be evaluated against another user's data.\n\nThis may lead to:\n\n- disclosure of rendered output intended for another user\n- authorization decisions made with the wrong request's context\n- cross-request mixing of session or other request-scoped state","state":0,"publishedAt":"2026-07-21T18:34:19+00:00","modifiedAt":"2026-09-10T03:50:12.3269755+00:00","affected":[{"ecosystem":"npm","name":"hono","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.11.8"},{"kind":"fixed","version":"4.12.27"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj","https://nvd.nist.gov/vuln/detail/CVE-2026-59896","https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.12.27"],"sourceUrl":"https://github.com/advisories/GHSA-hvrm-45r6-mjfj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hvrm-45r6-mjfj","identifiers":["GHSA-hvrm-45r6-mjfj","CVE-2026-59896"]},"retained":false,"historicalAffected":[]}],"coverage":[]}