{"answers":{"affected":"2 open source packages ship an affected version, including hono.","exploited":"There is no known exploitation of CVE-2026-71850 in the wild and no public exploit code.","fix":"Upgrade hono to 4.12.34 or later.","what":"CVE-2026-71850 is a medium-severity vulnerability in honojs hono, published on 7 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-71850 and fix it if it is affected.\n\nWhat it is: CVE-2026-71850 is a medium-severity vulnerability in honojs hono, published on 7 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-71850 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- hono (npm): affected from 3.8.0; fixed in 4.12.34\n- hono (npm): affected from 3.8.0; fixed in 4.12.34\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71850/ (Markdown: https://insights.sbomify.com/CVE-2026-71850/index.md)","id":"CVE-2026-71850","markdown":"https://insights.sbomify.com/CVE-2026-71850/index.md","name":"CVE-2026-71850","record":{"aliases":["CLEANSTART-2026-FE78375","ECHO-f837-bbec-a395","GHSA-f23p-vx2j-j53r","MINI-2jm4-pxh2-c3mv","MINI-6r9c-5h4w-57g9","MINI-fc38-c3rp-wg2j","MINI-ffcx-hj84-6xjm","MINI-fq9r-fxj4-qvvx","MINI-j377-w6vr-v9h8","MINI-jhwc-mmwr-4rgh","MINI-m7wf-4cw7-pr44","MINI-p4gf-247h-m992","MINI-r9jp-8pxv-cvf6","MINI-rpm4-c27c-5j8r"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript web framework","requires_auth":"low_privilege","summary":"Attackers can receive HTML rendered for other users due to memoization flaws, exposing sensitive data and secrets.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":4.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-488","name":"Exposure of Data Element to Wrong Session"}],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage, do not participate, and the retained result lives as long as the wrapped component, so it outlives the request that produced it. A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. This issue is fixed in version 4.12.34.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure","id":"CVE-2026-71850","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain","id":"CVE-2026-71851"},"packages":[{"ecosystem":"npm","fixed":["4.12.34"],"introduced":["3.8.0"],"last_affected":[],"package":"hono","purl":null,"source":"GHSA-f23p-vx2j-j53r"},{"ecosystem":"npm","fixed":["4.12.34"],"introduced":["3.8.0"],"last_affected":[],"package":"hono","purl":"pkg:npm/hono","source":"GHSA-f23p-vx2j-j53r"}],"prev":{"headline":"Hono: Proxy Helper does not remove response headers listed in the `Connection` header","id":"CVE-2026-71849"},"products":["hono"],"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-10","vendors":["honojs"]},"summary":"Attackers can receive HTML rendered for other users due to memoization flaws, exposing sensitive data and secrets.","url":"https://insights.sbomify.com/CVE-2026-71850/"}