Executive brief
Hono, a popular web framework, fails to validate cookie names when applications set cookies via the setCookie() function. If an application passes untrusted user input as a cookie name, attackers can inject invalid characters (such as newlines) that cause the browser to reject the Set-Cookie header, resulting in availability disruptions and runtime errors rather than successful header injection attacks.
Technical details
Hono before version 4.12.12 does not validate cookie names on the write path in setCookie(), serialize(), and serializeSigned() functions, allowing attackers to pass invalid characters (including control characters like \r and \n) when an application uses user-controlled input for the cookie name. This produces malformed Set-Cookie header values that violate HTTP specifications. Although theoretical header injection or response splitting attacks are possible, modern runtimes such as Node.js and Cloudflare Workers reject such invalid headers before sending the response, resulting in runtime errors. The vulnerability is classified as an input validation weakness (CWE-20) combined with improper CRLF handling (CWE-113), with impact primarily on availability rather than confirmed header injection. The fix is available in version 4.12.12 and later.
Affected products
- Hono Hono < 4.12.12
Timeline
- 2026-04-07: disclosed: Original advisory GHSA-26pp-8wgv-hjvm published
- 2026-04-07: patched: Fixed in version 4.12.12
- 2026-06-23: other: Duplicate advisory GHSA-55cm-p4ww-685g published
- 2026-09-24: other: Duplicate advisory GHSA-55cm-p4ww-685g withdrawn