Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Medium 4.3

In plain English

A medium-severity security flaw in hono from honojs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	hono	4.12.21	GHSA-3hrh-pfw6-9m5x

Affected products (as reported)

Vendor	Product	Versions
honojs	hono	< 4.12.21

Weakness: CWE-113, CWE-1287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x x_refsource_CONFIRM