Executive brief
Hono is a popular web framework used to build web applications. The framework's cookie utility has a flaw where it does not properly validate the sameSite and priority parameters, allowing attackers to inject malicious cookie attributes or additional headers if they can influence these values. This could enable an attacker to modify cookie security settings (like removing HttpOnly or Secure flags) or inject additional cookies into responses, potentially compromising session security.
Technical details
The vulnerability is a header injection flaw (CWE-113, CWE-1287) in the serialize() function of hono/cookie. The function validates domain and path options by rejecting characters ( ; , \r , \n ) that corrupt Set-Cookie header syntax, but does not apply the same validation to sameSite and priority options. Although TypeScript type signatures constrain these to specific literals, this constraint is not enforced at runtime. An attacker controlling sameSite or priority input can inject characters like ; or line-feed to append arbitrary attributes to the Set-Cookie header, potentially overriding Domain, Path, HttpOnly, Secure, or Max-Age attributes, or (on permissive runtimes) injecting a second Set-Cookie header. The attack requires user-controlled input to be passed to setCookie() or serialize(). A patch is available in Hono version 4.12.21.
Affected products
- Hono Hono < 4.12.21
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fix released in version 4.12.21