Hono Cookie Attribute Injection (CVE-2026-29086) – Medium

By /

Listen to this Post

CVE-2026-29086 is a medium-severity vulnerability in the Hono web framework for JavaScript runtimes, affecting versions prior to 4.12.4. The flaw exists in the `setCookie()` utility, which fails to validate or sanitize special characters—specifically semicolons (;), carriage returns (\r), and newline characters (\n)—within the `domain` and `path` parameters. Since the `Set-Cookie` header uses semicolons to delimit attributes (e.g., Domain=...; Path=...; HttpOnly), an attacker who can control or influence these cookie options can inject arbitrary additional attributes. For example, supplying a `domain` value like `example.com; HttpOnly; Secure` could result in a header that sets unintended cookie flags, potentially altering security policies such as `HttpOnly` or Secure, or even injecting malformed data to facilitate session fixation, cookie poisoning, or other client-side attacks. Exploitation requires user interaction (e.g., visiting a crafted page) and no authentication, making it accessible over the network. The vulnerability is rooted in improper input handling (CWE-1113) and has been patched in Hono version 4.12.4 by adding proper sanitization to the `setCookie()` function. No active exploitation in the wild has been reported as of publication, but the low attack complexity and network vector elevate the risk for unpatched instances .

dailycve form:

Platform: Hono
Version: <4.12.4
Vulnerability: Cookie Injection
Severity: Medium
date: Mar 4, 2026

Prediction: Patched (v4.12.4)

What Undercode Say:

Analytics

  • CVSS Score: 5.4 (MEDIUM) – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
  • Exploitability: Low complexity, network-based, no privileges required, user interaction needed
  • Impact: Low confidentiality / low integrity; no availability impact
  • Weakness: CWE-1113 (Inappropriate Comment Style – reflects improper delimiter handling)
  • Affected Component: `hono/cookie` helper (setCookie function)
  • Patch Commit: 44ae0c8
  • Advisory: GHSA-5pq2-9x2x-5p6w
  • Fix Release: v4.12.4 (2026-03-04)
  • Known Exploitation: None reported
  • Attack Vector: Malicious user input passed to domain/path cookie options

Exploit:

Example of a malicious cookie domain injection
Assumes attacker can influence 'domain' parameter passed to setCookie()
In a real attack, this could be delivered via crafted URL or form input
Vulnerable code pattern (Hono <4.12.4)
import { setCookie } from 'hono/cookie'
app.get('/set-bad-cookie', (c) => {
const userDomain = c.req.query('domain') || 'example.com' // untrusted input
setCookie(c, 'session', 'attacker', {
domain: userDomain, // no sanitization
path: '/'
})
return c.text('Cookie set')
})
Attacker request:
curl "http://target/set-bad-cookie?domain=example.com;%20HttpOnly;%20Secure"
Resulting Set-Cookie header (simplified):
Set-Cookie: session=attacker; Domain=example.com; HttpOnly; Secure; Path=/
The injected attributes become part of the cookie

Protection from this CVE:

1. Upgrade Hono to version 4.12.4 or later:

npm install hono@^4.12.4
or
yarn add hono@^4.12.4

2. Validate and sanitize all user input before passing to `setCookie` options:

// Example sanitization (if patching is delayed)
function sanitizeCookieAttribute(value) {
return value.replace(/[;\r\n]/g, '')
}
setCookie(c, 'name', 'value', {
domain: sanitizeCookieAttribute(userInput),
path: sanitizeCookieAttribute(userPath)
})

3. Review code for any use of `setCookie` with dynamic `domain` or `path` values.
4. Implement Content Security Policy (CSP) and HttpOnly/Secure flags as defense-in-depth.
5. Monitor logs for unusual cookie headers containing semicolons or control characters.

Impact

  • Session Manipulation: Attackers can alter cookie scope, duration, or security flags.
  • Bypass Security Controls: Injection of `HttpOnly` or `Secure` could be stripped or overridden.
  • Session Fixation: Malicious attributes may fix a session to a known value.
  • Data Leakage: Cookies could be made accessible to unintended domains/paths.
  • Limited Scope: Impact confined to cookie attributes; no direct remote code execution or data breach, but can facilitate further attacks.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: nvd.nist.gov
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Previous

D-Link DIR-513, Stack Buffer Overflow, CVE-2025-70233 (Critical)

Scroll to Top