GHSA-55cm-p4ww-685gMedium· 5.3▾ SunlitDuplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-26pp-8wgv-hjvm. This link is maintained to preserve external references.
Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g. \r or \n) when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie header values. In modern runtimes such as Node.js and Cloudflare Workers, such invalid header values are rejected and cause a runtime error before the response is sent, so header injection or response splitting could not be reproduced; the issue primarily affects correctness and robustness, resulting in runtime errors (availability) rather than confirmed header injection.
hono < 4.12.12Upgrade to a patched release:
hono 4.12.12Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()
CVE-2026-84363Medium· 5.9Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84364Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84365Medium· 6.5Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-71848Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-71849Low· 3.7Hono is a Web application framework that provides support for any JavaScript runtime