What is the CVSS score of CVE-2026-59896?

CVE-2026-59896 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-59896?

Yes, a patch is available for CVE-2026-59896. Update the affected software to the latest version immediately.

Hono Framework CVE-2026-59896

EUVD-2026-42326 MEDIUM

Race Condition (CWE-362)

2026-07-08 GitHub_M

GHSA-hvrm-45r6-mjfj

Information Disclosure Race Condition Red Hat Hono Honojs

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Race condition requires concurrent async requests (AC:H); no attacker credentials needed (PR:N); context leakage yields high confidentiality impact and low integrity impact across user boundaries.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 18:02 EUVD

Analysis Generated

Jul 08, 2026 - 17:14 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

17 npm packages depend on hono (13 direct, 5 indirect)

Ecosystem-wide dependent count for version 4.11.8.

DescriptionCVE.org

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

AnalysisAI

Server-side rendering in Hono's JSX module (versions 4.11.8 through before 4.12.27) fails to isolate context values per request, enabling cross-request data leakage under concurrent load. When async components yield at an await boundary, the shared context store can be overwritten by a concurrent in-flight request, causing createContext, useContext, jsxRenderer, or useRequestContext data from one user's session to bleed into another user's response. No public exploit has been identified at time of analysis, but the C:H CVSS impact rating reflects that leaked context values frequently carry sensitive per-user material such as authentication state, session tokens, or profile data.

Technical ContextAI

Hono is a lightweight, multi-runtime JavaScript/TypeScript web framework targeting Cloudflare Workers, Deno Deploy, Bun, and Node.js. The vulnerability is rooted in hono/jsx's server-side rendering pipeline, where context is managed through React-like APIs (createContext, useContext, jsxRenderer, useRequestContext). JavaScript's cooperative async model means an awaited expression yields the event loop, allowing another coroutine - here, a concurrent HTTP request handler - to execute and mutate shared state. If the context store is allocated globally or scoped to the renderer instance rather than per-request, the resumed component reads a now-corrupted context. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) precisely captures this: two execution flows compete over a shared context object without synchronization primitives. The affected CPE is cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*, covering all Hono releases in the vulnerable range regardless of runtime target.

RemediationAI

Upgrade Hono to version 4.12.27 or later, which resolves the per-request context isolation issue. The fix commit is available at https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f and the release is tagged at https://github.com/honojs/hono/releases/tag/v4.12.27. If an immediate upgrade is not feasible, a partial compensating control is to avoid storing sensitive data (session tokens, authentication results, PII) in Hono context APIs within async SSR components and instead pass such data as explicit component props, which are scoped to the component tree and not subject to the shared-context race. This workaround requires code refactoring and does not eliminate the underlying vulnerability, only reduces the blast radius. Disabling SSR entirely in favor of client-side rendering is a further option but carries significant SEO and performance trade-offs. Vendor-released patch version 4.12.27 is the recommended and definitive fix.