CVE-2026-71850: hono >= 3.8.0, < 4.12.34

Affected technology

hono · >= 3.8.0, < 4.12.34
honojs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

A user may receive a response containing HTML rendered for another user when both render the same memoized component with comparator equal props on the same warm instance, which may disclose another user's account or profile data, disclose request scoped secrets embedded in HTML such as CSRF tokens, or expose role specific content to users who should not receive it. Vendor/CNA’s CVSS 3.1 assessment (base score 4.8/10) rates confidentiality impact as high; integrity and availability impact as none.