CVE-2026-29086: Hono Cookie Attribute Injection Vulnerability
Summary
CVE-2026-29086: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie(). Affects hono versions < 4.12.4. Fixed in 4.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is a lightweight web framework designed for building web applications and APIs. It provides utilities for handling HTTP requests and responses, including the ability to set cookies through the setCookie() function. This function is essential for managing user sessions and maintaining state in web applications. However, it has a critical vulnerability that allows for cookie attribute injection, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from the setCookie() utility not properly validating input for the domain and path options. Specifically, it fails to reject unsafe characters such as semicolons, carriage returns, and newline characters. This oversight can lead to the injection of additional cookie attributes, which may alter cookie behavior and security settings. Attackers could exploit this flaw by manipulating cookie attributes, affecting cookie scoping and security attributes based on browser behavior. The issue is limited to attribute-level manipulation within a single Set-Cookie header, but it poses a moderate risk to applications that improperly handle user-controlled input.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.4
This is the first release that contains the fix.
npm install hono@4.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user-controlled input passed to the domain and path options of the setCookie() function is sanitized to remove semicolons, carriage returns, and newline characters. For example, you can implement a simple validation function:
function sanitizeInput(input) {
return input.replace(/[;\r\n]/g, '');
}
const domain = sanitizeInput(userInputDomain);
const path = sanitizeInput(userInputPath);
setCookie('name', 'value', { domain, path });
Conclusion
The CVE-2026-29086 vulnerability in the Hono framework poses a moderate risk due to improper validation in the setCookie() function. It is crucial to update to version 4.12.4 or later to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary measure until the update is applied.
See every vulnerability recorded for hono →
FAQ
CVE-2026-29086 is a vulnerability in the Hono framework that allows for cookie attribute injection due to improper validation of input in the setCookie() function.
If your application uses the Hono framework and allows user-controlled input in cookie settings, an attacker could manipulate cookie attributes, potentially compromising security.
All versions of Hono prior to 4.12.4 are affected by this vulnerability.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner for more information.
If an immediate update is not possible, implement input sanitization for the domain and path options in the setCookie() function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
