CVE-2026-29086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29086", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T20:51:43.484Z", "datePublished": "2026-03-04T22:09:01.488Z", "dateUpdated": "2026-03-05T15:42:10.524Z"}, "containers": {"cna": {"title": "Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()", "problemTypes": [{"descriptions": [{"cweId": "CWE-1113", "lang": "en", "description": "CWE-1113: Inappropriate Comment Style", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w"}, {"name": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073"}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"version": "< 4.12.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T22:09:01.488Z"}, "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}], "source": {"advisory": "GHSA-5pq2-9x2x-5p6w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:29:14.844587Z", "id": "CVE-2026-29086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:42:10.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:29:14.844587Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:29:15.872Z"}}], "cna": {"title": "Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()", "source": {"advisory": "GHSA-5pq2-9x2x-5p6w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.4"}]}], "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w", "name": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073", "name": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1113", "description": "CWE-1113: Inappropriate Comment Style"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T22:09:01.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29086", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:42:10.524Z", "dateReserved": "2026-03-03T20:51:43.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T22:09:01.488Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hono", "vendor": "honojs", "versions": [{"status": "affected", "version": "< 4.12.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "8ADA9966-4575-41CC-8905-E1F4E4CB5CA6", "versionEndExcluding": "4.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.12.4, la utilidad setCookie() no validaba los puntos y coma (;), los retornos de carro (\\r) o los caracteres de nueva l\u00ednea (\\n) en las opciones de dominio y ruta al construir la cabecera Set-Cookie. Dado que los atributos de las cookies est\u00e1n delimitados por puntos y coma, esto podr\u00eda permitir la inyecci\u00f3n de atributos de cookie adicionales si se pasaba una entrada no confiable a estos campos. Este problema ha sido parcheado en la versi\u00f3n 4.12.4."}], "id": "CVE-2026-29086", "lastModified": "2026-06-17T10:29:34.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:29:14.844587Z", "version": "2.0.3"}}]}, "published": "2026-03-04T23:16:10.593", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1113"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.12.4)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "hono", "source": "cna", "vendor": "honojs"}, "product": "hono", "vendor": "hono"}], "analysis": {"en": {"generated_at": "2026-04-16T13:05:01.297369+00:00", "value": {"mitigation_remediation": ["Upgrade Hono to version 4.12.4 or later, which implements validation of domain and path inputs.", "If immediate upgrade is not feasible, sanitize or whitelist domain and path arguments before calling setCookie() to ensure they contain only acceptable characters.", "Audit server-side code to confirm that no unsanitized values reach setCookie(); remove unnecessary domain or path options when they are not needed."], "summary": {"action": "Apply Patch", "impact": "Cookie Attribute Injection"}, "threat_synthesis": {"affected_systems": "All versions of the Hono web application framework released by honojs prior to 4.12.4 are affected. The vulnerability is present in Node.js runtimes that use these older Hono releases.", "description_and_impact": "The setCookie() utility in Hono did not escape semicolons, carriage returns, or newline characters present in the domain and path options. Because cookie attributes are separated by semicolons, an attacker can inject additional cookie attributes by supplying carefully crafted values in these fields, potentially allowing manipulation of cookie behavior such as setting custom flags, altering cookie names, or other unintended client-side state changes.", "risk_and_exploitability": "The CVSS score of 5.4 places this issue in the moderate risk range, yet the EPSS of less than 1% suggests low current exploitation likelihood. It is not listed in the CISA KEV catalog. An attacker would typically need to supply a crafted domain or path value\u2014often via a user-supplied request header or API parameter\u2014to trigger the injection during a server's response construction."}}}}, "created": "2026-03-05T09:05:37.214956+00:00", "updated": "2026-04-16T13:15:06.221574+00:00", "vendors": ["hono", "hono$PRODUCT$hono"]}