Executive brief
Hono, a popular web framework, fails to validate cookie names when writing Set-Cookie headers, allowing invalid characters like control characters to be included. While modern runtimes reject such malformed headers before sending them, this creates runtime errors that can disrupt application availability. The issue primarily affects application robustness rather than enabling confirmed header injection attacks.
Technical details
The vulnerability is an improper input validation issue (CWE-113, CWE-20) in Hono's cookie serialization functions. When applications call setCookie(), serialize(), or serializeSigned() with untrusted cookie names, invalid characters including CRLF sequences can pass through to generate malformed Set-Cookie HTTP headers. While the attack vector is network-based and requires no authentication or user interaction, modern runtimes such as Node.js and Cloudflare Workers validate and reject invalid header values before transmission, preventing actual header injection or response splitting. The practical impact is limited to denial-of-service through runtime errors rather than confirmed information disclosure or integrity compromise. The issue has been patched in version 4.12.12.
Affected products
- Hono hono < 4.12.12
Timeline
- 2026-06-23: disclosed: Advisory GHSA-55cm-p4ww-685g published; marked as duplicate of GHSA-26pp-8wgv-hjvm
- 2026-04-07: patched: Fix released in version 4.12.12
- 2026-09-24: advisory: Advisory GHSA-55cm-p4ww-685g withdrawn as duplicate