Lack of Cookie Name Validation in Hono by HonoJS

CVE-2026-56762

What is CVE-2026-56762?

The Hono framework prior to version 4.12.12 exhibits a flaw in its handling of cookie names within the setCookie(), serialize(), and serializeSigned() functions. This vulnerability allows for the inclusion of invalid characters, such as control characters, in user-controlled cookie names. The resulting malformed Set-Cookie header can lead to erroneous runtime behaviors in environments like Node.js and Cloudflare Workers, where such invalid headers may trigger runtime errors instead of confirmed security exploits. Consequently, this issue primarily jeopardizes the reliability and performance of applications using the Hono framework rather than exposing them to direct header injection risks.

References