{"uuid": "b552db37-6ae2-4d58-b298-d719f8b5a2da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71850", "type": "seen", "source": "https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378", "content": "# CVE-2026-71850: CVE-2026-71850: Server-Side Rendering Data Exposure in Hono JSX Memoization\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71850\n\n## Summary\nA session data exposure vulnerability in the Hono web application framework (hono/jsx module) allows consecutive users to receive cached HTML outputs containing private data. When JSX components wrapped in `memo()` are rendered on the server, the caching mechanism utilizes a module-level closure that persists across independent HTTP requests. When subsequent requests occur with matching props, the components are not re-evaluated, and cached HTML is served. If these components read request-scoped or session-specific data via ambient APIs, the data of the first user is exposed to subsequent users.\n\n## TL;DR\nA session isolation flaw in Hono's JSX SSR engine caches rendered HTML globally when using the `memo()` utility. This causes the framework to serve cached data (including CSRF tokens and user profile details) belonging to previous users to subsequent visitors when components are rendered with identical props.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.8 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 3.8.0, < 4.12.34\n- **Impact**: Information Disclosure (Request-scoped data, CSRF tokens)\n\n## Affected Systems\n\n- Hono applications using server-side rendering (SSR) with hono/jsx\n\n## Mitigation\n\n- Upgrade the hono package to version 4.12.34 or higher.\n- Remove the memo() wrapper from server-side rendered components.\n- Refactor components to accept all dynamic, request-scoped parameters as props rather than reading ambient context values.\n\n**Remediation Steps:**\n1. Verify current Hono framework version using npm list hono or yarn licenses list.\n2. Update Hono to version 4.12.34 or higher: npm install hono@4.12.34.\n3. Audit codebase for the import and usage of memo from 'hono/jsx' or 'hono/jsx/dom'.\n4. Remove memo() wrappers around server-side components that retrieve request-specific information.\n5. Deploy the patched application to production and monitor server access logs.\n\n## References\n\n- [Hono Security Advisory GHSA-f23p-vx2j-j53r](https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r)\n- [Official Fix Commit](https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71850) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:01:19.529811Z"}