Packages / hono / Security

ModerateVulnerabilityGHSA-f23p-vx2j-j53rPublished 7 Aug 2026

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Affected releases · hono

  • 4.x4.0.0 – 4.12.33Fixed in 4.12.34
  • 3.x3.8.0 – 3.12.12No fix on this line yet

On 4.x, the newest line:

npm install hono@4.12.34
4.x

  1. Affected

    4.0.0 – 4.12.33

    180 releases

  2. Fixed

    4.12.34 – 4.13.13

    15 releases, latest

3.x

  1. Not affected

    3.0.0 – 3.7.6

    52 releases

  2. Affected

    3.8.0 – 3.12.12

    40 releases

410 stable releases of hono, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for hono. It is read in your browser and sent nowhere.

What happens

The full text is not stored yet. Read it on osv.dev.