AIKIDO-2026-724213

TL;DR

During server-side rendering, hono/jsx stored context values in a process-wide structure instead of scoping them per request. When an async component reads context after an await while requests render concurrently, useContext() and useRequestContext() could observe another in-flight request's value. This can render a response with another user's context or evaluate an authorization check against the wrong request, leaking request-scoped data across requests. The fix isolates context per render so the provided value is preserved until the render's Promise resolves.