CVE-2026-56762Medium· 5.3▾ SunlitHono missing validation of cookie name on write path in setCookie()
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.4%
Cookie names are not validated on the write path when using setCookie(), serialize(), or serializeSigned() to generate Set-Cookie headers.
While certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.
This results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).
When applications use setCookie(), serialize(), or serializeSigned() with a user-controlled cookie name, invalid values (e.g., containing control characters such as \r or \n) can be used to construct malformed Set-Cookie header values.
For example:
Set-Cookie: legit
X-Injected: evil=value
However, in modern runtimes such as Node.js and Cloudflare Workers, such invalid header values are rejected and result in a runtime error before the response is sent.
As a result, the reported header injection / response splitting behavior could not be reproduced in these environments.
Applications that pass untrusted input as the cookie name to setCookie(), serialize(), or serializeSigned() may encounter runtime errors due to invalid header values.
In tested environments, malformed Set-Cookie headers are rejected before being sent, and the reported header injection behavior could not be reproduced.
This issue primarily affects correctness and robustness rather than introducing a confirmed exploitable vulnerability.
hono < 4.12.12Upgrade to a patched release:
hono 4.12.12Connected by shared product, vendor, weakness, or advisory.
GHSA-55cm-p4ww-685gMedium· 5.3Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
GHSA-cw3j-28qq-x3xhMedium· 6.5Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
CVE-2025-71381Medium· 6.5Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response
CVE-2026-47675Medium· 4.3Hono is a Web application framework that provides support for any JavaScript runtime
GHSA-3wcj-gjvf-fvchMedium· 4.8Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
GHSA-6623-4q32-82v8Low· 4.7Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS