The vulnerability stems from Hono’s JSX rendering engine not isolating context objects between concurrent requests. When an async component performs an await, the framework may inadvertently reuse a context that belonged to another in‑flight request, exposing createContext, useContext, jsxRenderer, or useRequestContext values injected by a different client. This data race—a classic CWE‑362 flaw—compromises confidentiality for any concurrently rendered request but does not alter authentication or privilege controls directly.

Hono releases from version 4.11.8 up to and including 4.12.26 are affected; any application employing these versions with server‑side JSX rendering is vulnerable. The issue was resolved in Hono 4.12.27 and later, so upgrading or patching is required for affected environments.

The CVSS score of 6.5 marks the weakness as moderate severity, while its EPSS score of less than 1 % indicates a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack path is remote, via overlapping HTTP requests that trigger server‑side rendering; an attacker must simultaneously send multiple requests containing JSX rendering with asynchronous logic, but no privileged access or code execution beyond reading data from other requests is required. Because the race condition depends on timing, successful exploitation is contingent on traffic patterns and framework behavior, contributing to the low EPSS value.