CVE-2026-59896

EUVD-2026-42326
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 9.14%
Affected Products (NVD)
VendorProductVersion
honohono
4.11.8 ≤
𝑥
< 4.12.27
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f
https://github.com/honojs/hono/releases/tag/v4.12.27
https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj