CVE-2026-71850: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

August 7, 2026

memo() from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user’s request.

References

github.com/advisories/GHSA-f23p-vx2j-j53r
github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f
github.com/honojs/hono/releases/tag/v4.12.34
github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
nvd.nist.gov/vuln/detail/CVE-2026-71850

Code Behaviors & Features

Detect and mitigate CVE-2026-71850 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →