6.5

CVE-2026-59896: hono Race Condition

CVSS: 6.5v3.1MediumAnalyzed
AliasesCGA-3qr4-jj3j-5rprCGA-5397-p8wg-r7vgCGA-xr3f-rvp8-7xff
Published 08-07-2026Last modified 08-07-2026
Open JSON

Vulnerability summary

CVE-2026-59896 is a medium (CVSS 6.5) Race Condition vulnerability in hono. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-6C7V-C8CV-7HPJ

Timeline

  1. 08-07-2026
    PublishedVulnerability first disclosed.
  2. 08-07-2026
    Last modifiedVulnerability information updated.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard32 products
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
  • commercial-gitlab-rails-ee-19.2< 19.2.7-r1
  • commercial-gitlab-rails-ee-19.3< 19.3.3-r1
  • commercial-gitlab-rails-ee-19.4< 19.4.1-r1
  • commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
Wolfi2 products
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.224.1-r0
Hono1 product
  • hono≥ 4.11.8, < 4.12.27
Honojs1 product
  • hono≥ 4.11.8, < 4.12.27
Npm1 product
  • hono≥ 4.11.8, < 4.12.27

5 vendors · 37 products

References

6 links