Exposure of Data Element to Wrong Session in hono - #VU140822
Published: August 3, 2026
Vulnerability identifier: #VU140822
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-488
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of data element to wrong session in the memo() function in hono/jsx when rendering server-side components that read request-specific ambient context through memoized rendering with comparator-equal props. A remote user can trigger rendering of a specially crafted request sequence to disclose sensitive information.
User interaction is required, and exploitation depends on both requests reaching the same warm instance in an order that populates the retained render output.
Affected software
hono
Remediation
Install security update from vendor's website.
hono - update to 4.12.34