Executive brief
Hono is a web framework used to build modern web applications. The setCookie(), serialize(), and serializeSigned() functions do not properly validate cookie names, which could allow an attacker to inject invalid characters (like line breaks) into Set-Cookie headers. However, in current runtime environments like Node.js and Cloudflare Workers, these malformed headers are automatically rejected before being sent, so practical exploitation is limited; the main risk is application runtime errors and availability disruption.
Technical details
The vulnerability is a missing input validation issue (CWE-113, CWE-20) in Hono's cookie handling functions. When setCookie(), serialize(), or serializeSigned() are called with a user-controlled cookie name parameter, the functions do not validate that the name contains only permitted characters. An attacker can supply a cookie name containing CRLF sequences (\r\n) or other control characters, resulting in a malformed Set-Cookie header (e.g., "Set-Cookie: legit\r\nX-Injected: evil=value"). However, in Node.js and Cloudflare Workers, the HTTP header validation layer rejects these malformed values and raises a runtime error before the response is transmitted. The vulnerability was patched in Hono version 4.12.12 by adding proper validation on the write path to reject invalid cookie names before serialization. The attack requires no authentication and is network-reachable, but actual header injection or response splitting could not be reproduced in tested environments due to runtime safeguards.
Affected products
- Hono Hono < 4.12.12
Timeline
- 2026-04-07: disclosed
- 2026-04-07: patched: Fixed in version 4.12.12
References
- https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm
- https://github.com/honojs/hono/commit/a586cd72e3f6122792e631ecf1817e5cabb803ec
- https://github.com/honojs/hono
- https://github.com/honojs/hono/releases/tag/v4.12.12
- https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie