CVE-2026-71850
1 advisory.
npm/hono CVE-2026-71850: medium 4.8, EPSS 0.27%
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Action: Upgrade hono to 4.12.34 or later.
npm i hono@4.12.34Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.8.0 | 4.12.34 | - |
Fixed versions
| 4.12.34 |
Sources
- osv: GHSA-f23p-vx2j-j53r
- https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
- https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f
- https://github.com/honojs/hono
- https://github.com/honojs/hono/releases/tag/v4.12.34
CVE-2026-71850 · published · modified · JSON