Hono Framework CVE-2026-59896

Exploitation requires the target application to run Hono versions 4.11.8 through before 4.12.27 with server-side rendering enabled via hono/jsx, and to use at least one async JSX component (containing an await expression) that reads from context via createContext, useContext, jsxRenderer, or useRequestContext. The race condition additionally requires that at least two requests be executing concurrently in the same runtime event loop at the moment the async component yields - meaning single-request-at-a-time or purely synchronous SSR deployments are not practically vulnerable. Applications that use Hono only for API routing without JSX SSR, or that use only synchronous components, are not affected. Client-side-only Hono deployments are not vulnerable. The CVSS PR:N vector confirms no authentication is required from the attacker's side to send HTTP requests; exploitation does not require the attacker to hold a valid session, only to trigger concurrent load.

The NVD CVSS 6.5 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N is consistent with the described vulnerability class. AC:H is appropriate because the race condition can only be triggered when two or more requests are concurrently executing async SSR components - a timing-dependent condition. However, in high-concurrency production deployments (edge functions serving many users simultaneously), the probability of hitting this window increases substantially and is not purely theoretical. C:H is well-justified: Hono context APIs are the idiomatic way to propagate request-scoped data, and developers commonly store authentication results, user profile data, and session state in these contexts. I:L reflects the possibility that a request receives and renders another user's context values, corrupting the integrity of the response it delivers. No EPSS data was provided in available intelligence; KEV status is not confirmed. This should be treated as a genuine priority for any Hono application performing SSR with async components and sensitive context data, particularly deployments on edge runtimes where request concurrency is high by design.

An attacker or non-malicious user sends a high volume of concurrent authenticated requests to a Hono SSR application. Under sufficient concurrency, a request handler resumes after an await in an async JSX component and reads context data that was written by a concurrently executing request belonging to a different user, causing a response to be rendered with another user's session or profile data. No public exploit code has been identified, but the race is mechanically straightforward to trigger under load testing conditions.