CVE-2026-29086 json
Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
published 8mo ago modified last mo. also EUVD-2026-9508 , GHSA-5pq2-9x2x-5p6w
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
Patch / fix
Is CVE-2026-29086 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | hono | <4.12.4 |
4.12.4 |
Affected products
- honojs hono
Classification
References
-
github.com
/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073
web, patch
-
github.com
/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-29086
advisory
-
github.com
/honojs/hono
package
Sources
- CVE List CVE-2026-29086
- GitHub Advisory GHSA-5pq2-9x2x-5p6w
- NVD CVE-2026-29086
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.