CVE-2026-39410

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.

PUBLISHED Reserved 2026-04-07 | Published 2026-04-08 | Updated 2026-04-08 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

References

github.com/...s/hono/security/advisories/GHSA-r5rp-j6wh-rvv4

github.com/...ommit/cc067c85592415cb1880ad3c61ed923472452ec0

github.com/honojs/hono/releases/tag/v4.12.12

cve.org (CVE-2026-39410)

nvd.nist.gov (CVE-2026-39410)

Download JSON