CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Attackers can receive HTML rendered for other users due to memoization flaws, exposing sensitive data and secrets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-71850?
CVE-2026-71850 is a medium-severity vulnerability in honojs hono, published on 7 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.
Weakness: CWE-488
Which versions are affected by CVE-2026-71850?
2 open source packages ship an affected version, including hono.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | From 3.8.0 | 4.12.34 |
hono npm | From 3.8.0 | 4.12.34 |
How do I fix CVE-2026-71850?
Upgrade hono to 4.12.34 or later.
Is CVE-2026-71850 being exploited?
There is no known exploitation of CVE-2026-71850 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FE78375, ECHO-f837-bbec-a395, GHSA-f23p-vx2j-j53r, MINI-2jm4-pxh2-c3mv, MINI-6r9c-5h4w-57g9, MINI-fc38-c3rp-wg2j and 8 more.