Executive brief
Hono is a web framework used to build applications that run on various JavaScript environments. In certain AWS Lambda configurations, the framework incorrectly combines multiple security and session cookies into a single line, which causes web browsers to ignore or misinterpret them. This can lead to broken user sessions, failed login attempts, or the failure of security features like CSRF protection.
Technical details
The vulnerability exists in the Hono AWS Lambda adapter's handling of HTTP responses. When using Application Load Balancer (ALB) single-header mode or VPC Lattice v2, the framework joins multiple 'Set-Cookie' headers into a single comma-separated value. This violates RFC 6265, as cookie attributes (such as 'Expires' dates) often contain commas, making it impossible for clients to reliably split the string back into individual cookies. Consequently, browsers may only process the first cookie, a malformed version, or none at all. This impact is limited to specific AWS integration modes; API Gateway and ALB with multi-value headers enabled are unaffected. The issue is resolved in version 4.12.25.
Affected products
- honojs Hono < 4.12.25
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published by maintainers
- 2026-06-22: disclosed: CVE published to NVD