Cookie Parsing Vulnerability in Hono Web Application Framework

CVE-2026-39410

What is CVE-2026-39410?

The Hono Web Application Framework has a vulnerability where a mismatch in cookie parsing between browsers and the parse() function allows cookie prefix protections to be bypassed. This flaw means that cookies treated as different by the browser may be normalized to the same key by parse(), leading attacker-controlled cookies being able to override legitimate ones. This security concern affects all versions prior to 4.12.12 and has been addressed in that release.

References