Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

GHSA-F23P-VX2J-J53R Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Exposure of Data Element to Wrong Session

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session in the memo function. An attacker can access sensitive information belonging to other users by sending requests that trigger the reuse of...