Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-5pq2-9x2x-5p6w | Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie() |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 04 Mar 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4. | |
| Title | Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() | |
| Weaknesses | CWE-1113 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-04T22:09:01.488Z
Reserved: 2026-03-03T20:51:43.484Z
Link: CVE-2026-29086
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-04T23:16:10.593
Modified: 2026-03-04T23:16:10.593
Link: CVE-2026-29086
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses