Vulnerability · Published Mar 4, 2026 · Assigned by GitHub_M

CVE-2026-29086Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Medium 5.4

In plain English

A medium-severity security flaw in hono from honojs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	hono	4.12.4	GHSA-5pq2-9x2x-5p6w

Affected products (as reported)

Vendor	Product	Versions
honojs	hono	< 4.12.4

Weakness: CWE-1113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w x_refsource_CONFIRM
https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073 x_refsource_MISC