CVE-2026-59896

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f	Patch
https://github.com/honojs/hono/releases/tag/v4.12.27	Release Notes
https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Desde la versión 4.11.8 antes de la 4.12.27, hono/jsx no aislaba los valores de contexto por solicitud durante la renderización del lado del servidor, permitiendo que los datos de createContext, useContext, jsxRenderer o useRequestContext de una solicitud en curso diferente fueran utilizados después de un await en un componente asíncrono. Este problema está solucionado en la versión 4.12.27.

Information

Published : 2026-07-08 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59896

Mitre link : CVE-2026-59896

CVE.ORG link : CVE-2026-59896

JSON object : View

Products Affected

hono

hono

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-59896", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59896", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:49:50.977740Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": ">= 4.11.8, < 4.12.27"}]}]}], "published": "2026-07-08T17:17:27.493", "references": [{"url": "https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/honojs/hono/releases/tag/v4.12.27", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Desde la versi\u00f3n 4.11.8 antes de la 4.12.27, hono/jsx no aislaba los valores de contexto por solicitud durante la renderizaci\u00f3n del lado del servidor, permitiendo que los datos de createContext, useContext, jsxRenderer o useRequestContext de una solicitud en curso diferente fueran utilizados despu\u00e9s de un await en un componente as\u00edncrono. Este problema est\u00e1 solucionado en la versi\u00f3n 4.12.27."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9B42B113-3A7D-419F-BBEF-8EC6D7FDAC41", "versionEndExcluding": "4.12.27", "versionStartIncluding": "4.11.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}