Executive brief
Hono's setCookie() utility function, used to set HTTP cookies in web applications, fails to properly validate user input in the domain and path parameters. An attacker who controls these inputs could inject additional cookie attributes (like SameSite or Secure flags) via special characters, potentially weakening cookie security or changing cookie scope. This requires an application to pass untrusted user input directly to the setCookie() function.
Technical details
The setCookie() utility in Hono does not sanitize semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when building the Set-Cookie HTTP header. Since cookie attributes are delimited by semicolons, an attacker can inject additional attributes by including these characters. For example, malicious input in the domain field could append unintended attributes like SameSite=None or Secure. Modern HTTP runtime restrictions prevent full CRLF header injection attacks, limiting this to attribute-level manipulation within a single Set-Cookie header. The vulnerability is fixed in version 4.12.4 by rejecting these unsafe characters in domain and path validation. Exploitation requires an application to directly pass user-controlled input to setCookie() domain or path options, making it a "developer misuse" scenario rather than a framework-level flaw.
Affected products
- Honojs hono < 4.12.4
Timeline
- 2026-03-04: disclosed
- 2026-03-04: patched: Fixed in version 4.12.4