Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before
    4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing
    createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be
    used after an await in an async component. This issue is fixed in version 4.12.27. (CVE-2026-59896)

ID	Name	Product	Family	Type	Severity
461314	Echo: hono: security update to 4.12.27	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461314	Echo: hono: security update to 4.12.27	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445030	SCA: security update for hono (GHSA-hvrm-45r6-mjfj)	Tenable Cloud Security	SCA Checks	Local	medium
445030	SCA: security update for hono (GHSA-hvrm-45r6-mjfj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-59896

medium

Tenable Plugins

medium

medium

medium

medium