{"metadata": {"vulnerability": "CVE-2026-71850", "count": 65, "kinds": {"milestone": 21, "sighting": 1, "kev": 0, "other": 43}}, "data": [{"timestamp": "2026-08-07T18:26:53.523Z", "date_only": false, "value": "2026-08-07T18:26:53.523Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-71850", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-07T18:41:17.068Z", "date_only": false, "value": "2026-08-07T18:41:17.068Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71850", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-07T18:41:17.068Z", "date_only": false, "value": "2026-08-07T18:41:17.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-71850", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-07T18:42:01Z", "date_only": false, "value": "2026-08-07T18:42:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F23P-VX2J-J53R", "record": "GHSA-F23P-VX2J-J53R", "field": "published"}, {"timestamp": "2026-08-07T18:42:01Z", "date_only": false, "value": "2026-08-07T18:42:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F23P-VX2J-J53R", "record": "GHSA-F23P-VX2J-J53R", "field": "modified"}, {"timestamp": "2026-08-07T19:18:54.240Z", "date_only": false, "value": "2026-08-07T19:18:54.240", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71850", "record": "FKIE_CVE-2026-71850", "field": "published"}, {"timestamp": "2026-08-07T22:31:14.254Z", "date_only": false, "value": "2026-08-07T22:31:14.254519Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378", "record": "CVE-2026-71850", "field": "creation_timestamp", "uuid": "1b5fbd6d-e8d4-4320-bdd6-faa648212ab8", "content": "# CVE-2026-71850: CVE-2026-71850: Server-Side Rendering Data Exposure in Hono JSX Memoization\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71850\n\n## Summary\nA session data exposure vulnerability in the Hono web application framework (hono/jsx module) allows consecutive users to receive cached HTML outputs containing private data. When JSX components wrapped in `memo()` are rendered on the server, the caching mechanism utilizes a module-level closure that persists across independent HTTP requests. When subsequent requests occur with matching props, the components are not re-evaluated, and cached HTML is served. If these components read request-scoped or session-specific data via ambient APIs, the data of the first user is exposed to subsequent users.\n\n## TL;DR\nA session isolation flaw in Hono's JSX SSR engine caches rendered HTML globally when using the `memo()` utility. This causes the framework to serve cached data (including CSRF tokens and user profile details) belonging to previous users to subsequent visitors when components are rendered with identical props.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.8 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 3.8.0, < 4.12.34\n- **Impact**: Information Disclosure (Request-scoped data, CSRF tokens)\n\n## Affected Systems\n\n- Hono applications using server-side rendering (SSR) with hono/jsx\n\n## Mitigation\n\n- Upgrade the hono package to version 4.12.34 or higher.\n- Remove the memo() wrapper from server-side rendered components.\n- Refactor components to accept all dynamic, request-scoped parameters as props rather than reading ambient context values.\n\n**Remediation Steps:**\n1. Verify current Hono framework version using npm list hono or yarn licenses list.\n2. Update Hono to version 4.12.34 or higher: npm install hono@4.12.34.\n3. Audit codebase for the import and usage of memo from 'hono/jsx' or 'hono/jsx/dom'.\n4. Remove memo() wrappers around server-side components that retrieve request-specific information.\n5. Deploy the patched application to production and monitor server access logs.\n\n## References\n\n- [Hono Security Advisory GHSA-f23p-vx2j-j53r](https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r)\n- [Official Fix Commit](https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71850) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378"}, {"timestamp": "2026-08-10T13:26:46.686Z", "date_only": false, "value": "2026-08-10T13:26:46.686577Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71850", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-10T13:26:46.686Z", "date_only": false, "value": "2026-08-10T13:26:46.686577Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71850", "record": "FKIE_CVE-2026-71850", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-10T13:26:55.984Z", "date_only": false, "value": "2026-08-10T13:26:55.984Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-71850", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-10T13:26:55.984Z", "date_only": false, "value": "2026-08-10T13:26:55.984Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71850", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-13T12:10:09Z", "date_only": false, "value": "2026-08-13T12:10:09Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-YP71540", "record": "CLEANSTART-2026-YP71540", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-BG95605", "record": "CLEANSTART-2026-BG95605", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-DE19416", "record": "CLEANSTART-2026-DE19416", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-DF93563", "record": "CLEANSTART-2026-DF93563", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-FV05780", "record": "CLEANSTART-2026-FV05780", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-GK07670", "record": "CLEANSTART-2026-GK07670", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-HB40236", "record": "CLEANSTART-2026-HB40236", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-IK31603", "record": "CLEANSTART-2026-IK31603", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-IP72198", "record": "CLEANSTART-2026-IP72198", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-JK87945", "record": "CLEANSTART-2026-JK87945", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-JL69609", "record": "CLEANSTART-2026-JL69609", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-MV56150", "record": "CLEANSTART-2026-MV56150", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-RC29908", "record": "CLEANSTART-2026-RC29908", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-TC67424", "record": "CLEANSTART-2026-TC67424", "field": "published"}, {"timestamp": "2026-09-01T11:17:16Z", "date_only": false, "value": "2026-09-01T11:17:16Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-UX73923", "record": "CLEANSTART-2026-UX73923", "field": "published"}, {"timestamp": "2026-09-07T22:00:00Z", "date_only": false, "value": "2026-09-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-07T22:00:00Z", "date_only": false, "value": "2026-09-07T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-07T22:00:00Z", "date_only": false, "value": "2026-09-07T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-09-10T22:00:00Z", "date_only": false, "value": "2026-09-10T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-10T22:00:00Z", "date_only": false, "value": "2026-09-10T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-11T09:12:56.698Z", "date_only": false, "value": "2026-09-11T09:12:56.698+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3221", "record": "WID-SEC-W-2026-3221", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-18T09:42:04.022Z", "date_only": false, "value": "2026-09-18T09:42:04.022431Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-FE78375", "record": "CLEANSTART-2026-FE78375", "field": "published"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-BG95605", "record": "CLEANSTART-2026-BG95605", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-DE19416", "record": "CLEANSTART-2026-DE19416", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-DF93563", "record": "CLEANSTART-2026-DF93563", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-FV05780", "record": "CLEANSTART-2026-FV05780", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-GK07670", "record": "CLEANSTART-2026-GK07670", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-HB40236", "record": "CLEANSTART-2026-HB40236", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-IK31603", "record": "CLEANSTART-2026-IK31603", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-IP72198", "record": "CLEANSTART-2026-IP72198", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-JK87945", "record": "CLEANSTART-2026-JK87945", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-JL69609", "record": "CLEANSTART-2026-JL69609", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-MV56150", "record": "CLEANSTART-2026-MV56150", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-RC29908", "record": "CLEANSTART-2026-RC29908", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-TC67424", "record": "CLEANSTART-2026-TC67424", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-UX73923", "record": "CLEANSTART-2026-UX73923", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-YP71540", "record": "CLEANSTART-2026-YP71540", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-BG95605", "record": "CLEANSTART-2026-BG95605", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-DE19416", "record": "CLEANSTART-2026-DE19416", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-DF93563", "record": "CLEANSTART-2026-DF93563", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-FV05780", "record": "CLEANSTART-2026-FV05780", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-GK07670", "record": "CLEANSTART-2026-GK07670", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-HB40236", "record": "CLEANSTART-2026-HB40236", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-IK31603", "record": "CLEANSTART-2026-IK31603", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-IP72198", "record": "CLEANSTART-2026-IP72198", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-JK87945", "record": "CLEANSTART-2026-JK87945", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-JL69609", "record": "CLEANSTART-2026-JL69609", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-MV56150", "record": "CLEANSTART-2026-MV56150", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-RC29908", "record": "CLEANSTART-2026-RC29908", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-TC67424", "record": "CLEANSTART-2026-TC67424", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-UX73923", "record": "CLEANSTART-2026-UX73923", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-YP71540", "record": "CLEANSTART-2026-YP71540", "field": "withdrawn"}, {"timestamp": "2026-10-08T19:05:42Z", "date_only": false, "value": "2026-10-08T19:05:42Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-FE78375", "record": "CLEANSTART-2026-FE78375", "field": "modified"}, {"timestamp": "2026-10-24T15:10:00.190Z", "date_only": false, "value": "2026-10-24T15:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71850", "record": "FKIE_CVE-2026-71850", "field": "lastModified"}]}