Race Condition Affecting hono package, versions >=4.11.8 <4.12.27

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Race Condition through server-side rendering context handling in createContext and useContext. An attacker can read another in-flight request’s provided value by causing an async component to suspend on await and then resume while concurrent SSR requests are rendering through the same provider stack. When useContext() is called after the suspension point, the render can observe a value from a different request instead of its own session-scoped data. This can leak user-specific HTML or cause authorization checks and other request-scoped decisions to use the wrong user’s context.

Notes

• On runtimes without AsyncLocalStorage, the vulnerable path falls back to a process-local store only for synchronous work; a useContext() read after await in an async SSR component can therefore degrade to the context’s default value rather than retain the request’s provided value.
• The leak is limited to server-side rendering in the async-suspension path; synchronous components and client-side DOM rendering are not part of the affected execution flow.

• GitHub Commit
• Maintainer's Advisory