Moderate severityNVD Advisory· Published Mar 4, 2026· Updated Mar 5, 2026
Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
CVE-2026-29086
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
hononpm | < 4.12.4 | 4.12.4 |
Affected products
1Patches
12 files changed · +30 −0
src/utils/cookie.test.ts+24 −0 modified@@ -270,6 +270,30 @@ describe('Set cookie', () => { }).toThrowError('Partitioned Cookie must have Secure attributes') }) + it('Should throw Error cookie with domain or path containing ";", "\\r", or "\\n"', () => { + // domain + expect(() => { + serialize('great_cookie', 'banana', { domain: 'example.com;evil' }) + }).toThrowError('domain must not contain ";", "\\r", or "\\n"') + expect(() => { + serialize('great_cookie', 'banana', { domain: 'example.com\revil' }) + }).toThrowError('domain must not contain ";", "\\r", or "\\n"') + expect(() => { + serialize('great_cookie', 'banana', { domain: 'example.com\nevil' }) + }).toThrowError('domain must not contain ";", "\\r", or "\\n"') + + // path + expect(() => { + serialize('great_cookie', 'banana', { path: '/;evil' }) + }).toThrowError('path must not contain ";", "\\r", or "\\n"') + expect(() => { + serialize('great_cookie', 'banana', { path: '/\revil' }) + }).toThrowError('path must not contain ";", "\\r", or "\\n"') + expect(() => { + serialize('great_cookie', 'banana', { path: '/\nevil' }) + }).toThrowError('path must not contain ";", "\\r", or "\\n"') + }) + it('Should serialize cookie with lowercase priority values', () => { const lowSerialized = serialize('test_cookie', 'value', { priority: 'low',
src/utils/cookie.ts+6 −0 modified@@ -161,6 +161,12 @@ const _serialize = (name: string, value: string, opt: CookieOptions = {}): strin } } + for (const key of ['domain', 'path'] as (keyof CookieOptions)[]) { + if (opt[key] && /[;\r\n]/.test(opt[key] as string)) { + throw new Error(`${key} must not contain ";", "\\r", or "\\n"`) + } + } + if (opt && typeof opt.maxAge === 'number' && opt.maxAge >= 0) { if (opt.maxAge > 34560000) { // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.6.2
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-5pq2-9x2x-5p6wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-29086ghsaADVISORY
- github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073ghsax_refsource_MISCWEB
- github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6wghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.