CVE-2026-59896: hono/jsx does not isolate context per request, leading to cross-request data disclosure
hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext() could return a value from a different in-flight request.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-59896 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →