CVE-2026-47675 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.
A cookie injection vulnerability has been identified in the Hono web application framework, prior to version 4.12.21. The issue arises in the serialize() function of hono/cookie, which validates domain and path options to prevent corruption of Set-Cookie header syntax. However, this validation is not applied to the sameSite and priority options. As a result, an application that accepts user-controlled input for these options may inadvertently create a Set-Cookie header with additional attributes chosen by the attacker. This vulnerability could allow for cookie attribute injection, potentially overriding important cookie settings, or even injecting a second Set-Cookie header in responses from runtimes with lax header validation.
Users can upgrade to Hono version 4.12.21 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-1287 | Improper Validation of Specified Type of Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono hono | < 4.12.21 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |