https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:25:05 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-bn50669 <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>CVE-2026-59896 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>CVE-2026-59896 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bn50669 https://cve.radiocsirt.org/vuln/euvd-2026-334018 EUVD-2026-334018 https://cve.radiocsirt.org/vuln/euvd-2026-334018 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59896 <p>Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.</p> <p>Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59896 https://cve.radiocsirt.org/vuln/ghsa-hvrm-45r6-mjfj <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>`hono/jsx` did not isolate context values per request during server-side rendering. While an async component was suspended on `await`, its provided context value stayed observable to other requests rendering concurrently, so `useContext()` could return a value from a different in-flight request.</p> <p>### Details</p> <p>During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request&#39;s render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request&#39;s context.</p> <p>This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:</p> <p>- `createContext()` / `useContext()` - the `jsxRenderer` middleware and `useRequestContext()`</p> <p>It arises only when context is read after an `await` inside an async component while requests render concurrently. Reading context synchronously (before any `await`), purely synchronous rendering, and client-side (DOM) rendering are not affected.</p> <p>### Impact</p> <p>Under concurrent requests, a response could be rendered with another request&#39;s context. A user may receive HTML rendered for a different user, and an authorization check performed after an `await` may be evaluated against another user&#39;s data.</p> <p>This may lead to:</p> <p>- disclosure of rendered output intended for another user - authorization decisions made with the wrong request&#39;s context - cross-request mixing o…</p> <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>`hono/jsx` did not isolate context values per request during server-side rendering. While an async component was suspended on `await`, its provided context value stayed observable to other requests rendering concurrently, so `useContext()` could return a value from a different in-flight request.</p> <p>### Details</p> <p>During server-side rendering, context values were kept in a process-wide structure rather than scoped to each request&#39;s render. While an async component awaited, another request entering the same provider could observe or replace the value; when the first render resumed, it could read the other request&#39;s context.</p> <p>This affects the usual ways request-scoped data is passed through a server-rendered JSX tree:</p> <p>- `createContext()` / `useContext()` - the `jsxRenderer` middleware and `useRequestContext()`</p> <p>It arises only when context is read after an `await` inside an async component while requests render concurrently. Reading context synchronously (before any `await`), purely synchronous rendering, and client-side (DOM) rendering are not affected.</p> <p>### Impact</p> <p>Under concurrent requests, a response could be rendered with another request&#39;s context. A user may receive HTML rendered for a different user, and an authorization check performed after an `await` may be evaluated against another user&#39;s data.</p> <p>This may lead to:</p> <p>- disclosure of rendered output intended for another user - authorization decisions made with the wrong request&#39;s context - cross-request mixing o…</p> https://cve.radiocsirt.org/vuln/ghsa-hvrm-45r6-mjfj