[GHSA] GHSA-f23p-vx2j-j53r (medium) — Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

GHSA-f23p-vx2j-j53r Severity: medium CVE: CVE-2026-71850

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

### Summary

`memo()` from `hono/jsx` retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTM