hono/jsx does not isolate context per request, leading to cross-request data disclosure

### Summary `hono/jsx` did not isolate context values per request during server-side rendering. While an async component was suspended on `await`, its provided context value stayed observable to other requests rendering concurrently, so `useContext()` could return a value from a different in-flight request. ### Details During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context. This affects the usual ways request-scoped data is passed through a server-rendered JSX tree: - `createContext()` / `useContext()` - the `jsxRenderer` middleware and `useRequestContext()` It arises only when context is read after an `await` inside an async component while requests render concurrently. Reading context synchronously (before any `await`), purely synchronous rendering, and client-side (DOM) rendering are not affected. ### Impact Under concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an `await` may be evaluated against another user's data. This may lead to: - disclosure of rendered output intended for another user - authorization decisions made with the wrong request's context - cross-request mixing of session or other request-scoped state

Source published

21 Jul 2026 18:34:19 UTC

Source modified

10 Sep 2026 03:50:12 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Publisher rating · MODERATE