CVE-2026-54287 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.
A vulnerability in the Hono web application framework, affecting versions prior to 4.12.25, has been identified on AWS Lambda. In this environment, the Application Load Balancer (ALB) single-header response and the VPC Lattice v2 response improperly merge multiple 'Set-Cookie' headers into a single comma-separated value. This mismanagement occurs because commas can be present within cookie attributes, such as 'Expires' dates', leading clients to incorrectly parse or completely drop the cookies. The issue arises only with ALB in single-header mode, which is the default setting, and VPC Lattice v2. In contrast, API Gateway v1/v2 and ALB with multi-value headers enabled are not affected, as they correctly handle 'Set-Cookie' headers using an array format.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/security/advisories/GHSA-j6c9-x7qj-28xf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hono | < 4.12.25 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |