Web Application Framework Vulnerability in Hono by HonoJS
CVE-2026-71850

4.8MEDIUM

Key Information:

Vendor

Honojs

Status
Hono
Vendor
CVE Published:
7 August 2026

What is CVE-2026-71850?

Hono, a web application framework from HonoJS, has a flaw in the memo() function from hono/jsx that can lead to the unintended retention of HTML output from server-side renders. This vulnerability allows the potential exposure of sensitive information, including user account details, CSRF tokens, and role-specific content. The issue arises because memo() compares components solely based on props, neglecting to consider request-scoped values read during component rendering. Fixes are available in version 4.12.34, addressing this critical flaw and improving overall application security.

Affected Version(s)

hono >= 3.8.0, < 4.12.34

References

https://github.com/honojs/hono/security/advisories/GHSA-f...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.