Exposure of Data Element to Wrong Session in hono - CVE-2026-71850
Published: August 3, 2026 / Updated: August 8, 2026
Vulnerability identifier: #VU140822
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71850
CWE-ID: CWE-488
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of data element to wrong session in the memo() function in hono/jsx when rendering server-side components that read request-specific ambient context through memoized rendering with comparator-equal props. A remote user can trigger rendering of a specially crafted request sequence to disclose sensitive information.
User interaction is required, and exploitation depends on both requests reaching the same warm instance in an order that populates the retained render output.
Affected software
hono
IBM App Connect Enterprise
Informix Dynamic Server
IBM App Connect Enterprise
Informix Dynamic Server
How to mitigate CVE-2026-71850
Install security update from vendor's website.
hono - update to 4.12.34
IBM App Connect Enterprise - update to 13.0.8.2
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
IBM App Connect Enterprise - update to 13.0.8.2
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16