CVE-2026-59896

Medium

Advisory

Published 21 Jul 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: 1 of 1; affected package

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
hononpm	4.12.3, 4.12.4, 4.12.5, 4.12.7+6 more	4.12.27	21

OSV records: GHSA-hvrm-45r6-mjfj

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

rocketchatrocketchat-server

7.0.2

4 of 12 See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
rocketchat/account-service :8.6.1	44af8ac4e711	hono@4.12.25	4.12.27
rocketchat/authorization-service :8.6.1	6bc18fb5d0e5	hono@4.12.25	4.12.27
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	hono@4.12.25	4.12.27
rocketchat/presence-service :8.6.1	c1170bdfe797	hono@4.12.25	4.12.27

Open the chart page →

12,279

openclawopenclaw-helm

1.5.40

1 of 2 See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	hono@4.12.18	4.12.27

Open the chart page →

5,660

docmosthelmforge

1.2.11

1 of 4 See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
docmost/docmost :0.95.0	41c8d777cf23	hono@4.12.25	4.12.27

Open the chart page →

5,564

ghostcloudpirates-ghost

0.20.22

1 of 3 See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
library/ghost :6.63.0	e05bc1169fb2	hono@4.12.18	4.12.27

Open the chart page →

7,146

ghost-on-kubernetesghost-on-kubernetes-helm

1.1.2

1 of 3 See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes :main	dd991bafa85e	hono@4.12.18	4.12.27

Open the chart page →

1,447

openclaw-with-brainopenclaw-with-brain

0.1.67

1 of 3 See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	hono@4.12.25	4.12.27

Open the chart page →

5,218

nocodbzekker6

1.10.0

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	hono@4.12.8	4.12.27

Open the chart page →

4,016

directusdirectus-io

2.1.0

1 of 3 See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
directus/directus :12.0.2	9c8470ea465c	hono@4.12.4	4.12.27

Open the chart page →

7,473

ghostfolioghostfolio

0.5.4

1 of 3 See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	hono@4.12.14	4.12.27

Open the chart page →

3,123

ghostgroundhog2k

0.212.12

1 of 1 See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
library/ghost :6.63.0	e05bc1169fb2	hono@4.12.18	4.12.27

Open the chart page →

2,000

n8nn8n-helm

2.25.7

1 of 1 See more

2,575

adeptia-automate-mcpadeptia-automate-mcp

1.0.0

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	hono@4.12.5	4.12.27
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	hono@4.12.7	4.12.27

Open the chart page →

3,600

mcp-for-argocdchristianhuth

2.0.0

1 of 1 See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/argoproj-labs/mcp-for-argocd :v0.9.0	dffc6c719d86	hono@4.12.14	4.12.27

Open the chart page →

1,947

bytestashhelmforge

1.0.0

1 of 1 See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/jordan-dalby/bytestash :1.5.12	eb4f736b8cd4	hono@4.12.26	4.12.27

Open the chart page →

739

ghosthelmforge

1.2.6

1 of 3 See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
library/ghost :6.62.0	a7a268bbfb7f	hono@4.12.18	4.12.27

Open the chart page →

2,463

portfolio-trackerkubernetes-homelab-helm-charts

0.1.0

1 of 3 See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
ghcr.io/harish2k01/portfolio-tracker :0.1.0	56efa3085895	hono@4.12.23	4.12.27

Open the chart page →

1,498

lynxpromptlynxprompt

0.1.2

1 of 3 See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
drumsergio/lynxprompt :2.0.75	c6afb6679301	hono@4.12.18	4.12.27

Open the chart page →

1,852

unleash-enterpriseunleash

1.0.3

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-59896.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	hono@4.12.3	4.12.27

Open the chart page →

2,028

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
library/ghost :6.63.0	e05bc1169fb2	hono@4.12.18	4.12.27	2
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	hono@4.12.5	4.12.27	1
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	hono@4.12.7	4.12.27	1
directus/directus :12.0.2	9c8470ea465c	hono@4.12.4	4.12.27	1
docmost/docmost :0.95.0	41c8d777cf23	hono@4.12.25	4.12.27	1
drumsergio/lynxprompt :2.0.75	c6afb6679301	hono@4.12.18	4.12.27	1
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	hono@4.12.14	4.12.27	1
library/ghost :6.62.0	a7a268bbfb7f	hono@4.12.18	4.12.27	1
n8nio/n8n :2.25.7	761374d4eb84	hono@4.12.18	4.12.27	1
nocodb/nocodb :0.301.5	d9516f0bf546	hono@4.12.8	4.12.27	1
rocketchat/account-service :8.6.1	44af8ac4e711	hono@4.12.25	4.12.27	1
rocketchat/authorization-service :8.6.1	6bc18fb5d0e5	hono@4.12.25	4.12.27	1
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	hono@4.12.25	4.12.27	1
rocketchat/presence-service :8.6.1	c1170bdfe797	hono@4.12.25	4.12.27	1
unleashorg/unleash-enterprise :7.5.0	245aeba40053	hono@4.12.3	4.12.27	1
ghcr.io/argoproj-labs/mcp-for-argocd :v0.9.0	dffc6c719d86	hono@4.12.14	4.12.27	1
ghcr.io/harish2k01/portfolio-tracker :0.1.0	56efa3085895	hono@4.12.23	4.12.27	1
ghcr.io/jordan-dalby/bytestash :1.5.12	eb4f736b8cd4	hono@4.12.26	4.12.27	1
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	hono@4.12.25	4.12.27	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	hono@4.12.18	4.12.27	1
ghcr.io/sredevopsorg/ghost-on-kubernetes :main	dd991bafa85e	hono@4.12.18	4.12.27	1