Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w
Patch x_refsource_misc
https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073
Scores
CVSS v3
5.4
EPSS
0.0003
EPSS Percentile
10.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1113
Status
published
Products (2)
hono/hono
< 4.12.4
npm/hono
0 - 4.12.4npm
Published
Mar 04, 2026
Tracked Since
Mar 05, 2026