---
id: CVE-2026-59896
aliases:
  - GHSA-hvrm-45r6-mjfj
title: >-
  hono/jsx does not isolate context per request, leading to cross-request data
  disclosure
summary: >-
  hono/jsx does not isolate context per request, leading to cross-request data
  disclosure
severity: medium
cvss: 6.5
cwe:
  - CWE-362
vendor: hono
product: hono
ecosystem: npm
affected:
  - 'hono >= 4.11.8, < 4.12.27'
patched:
  - hono 4.12.27
published: '2026-07-21'
updated: '2026-07-21'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hvrm-45r6-mjfj'
references:
  - url: 'https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59896'
  - url: >-
      https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f
  - url: 'https://github.com/honojs/hono/releases/tag/v4.12.27'
  - url: 'https://github.com/advisories/GHSA-hvrm-45r6-mjfj'
tags:
  - ghsa
  - npm
epss: 0.00299
epssPercentile: 0.22796
ingestedAt: '2026-07-21T18:53:06.630Z'
---

## Overview

### Summary

`hono/jsx` did not isolate context values per request during server-side rendering. While an async component was suspended on `await`, its provided context value stayed observable to other requests rendering concurrently, so `useContext()` could return a value from a different in-flight request.

### Details

During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request's render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request's context.

This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:

- `createContext()` / `useContext()`
- the `jsxRenderer` middleware and `useRequestContext()`

It arises only when context is read after an `await` inside an async component while requests render concurrently. Reading context synchronously (before any `await`), purely synchronous rendering, and client-side (DOM) rendering are not affected.

### Impact

Under concurrent requests, a response could be rendered with another request's context. A user may receive HTML rendered for a different user, and an authorization check performed after an `await` may be evaluated against another user's data.

This may lead to:

- disclosure of rendered output intended for another user
- authorization decisions made with the wrong request's context
- cross-request mixing of session or other request-scoped state

## Affected packages

- `hono >= 4.11.8, < 4.12.27`

## Remediation

Upgrade to a patched release:

- `hono 4.12.27`