The Hono web framework contains a flaw in its memo() function, which can hold a server‑side rendered output across separate user requests. When memoized components compare only on props but ignore request‑scoped data, a rendered response can be served to a different user than the one that originally produced it. This allows an attacker to read another user’s account or profile information, request‑scoped secrets (such as CSRF tokens) or role‑specific content, thereby breaching confidentiality.

The vulnerability affects the Hono framework from version 3.8.0 through version 4.12.33. Any application built with these versions that uses memo() around components that read request context or other per‑user data is potentially impacted.

The issue receives a CVSS score of 4.8, indicating moderate risk. No EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the application to render a memoized component with identical props for two different user contexts; an attacker can trigger such request patterns by submitting queries to the affected endpoint. Once executed, the attacker gains access to sensitive data belonging to another user. Because the flaw relates to data persistence rather than traditional code execution, the attack vector is limited to information disclosure through normal usage of the application.