PT-2026-23077 · Hono · Hono

Tarpeg007 · Published 2026-03-04 · Updated 2026-05-18 · CVE-2026-29086

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4

Description The setCookie() utility did not properly validate semicolons (;), carriage returns (r), or newline characters ( ) in the domain and path options when creating the Set-Cookie header. Because cookie attributes are separated by semicolons, this could allow an attacker to inject additional cookie attributes if untrusted input is used in these fields. The issue stems from the interpolation of the domain and path options without rejecting unsafe characters. Including characters like ;, r, or could lead to unintended cookie attributes being added to the header, potentially affecting cookie scoping or security. Exploitation requires misuse of cookie options at the application level.

Recommendations Update to version 4.12.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

CWE-1113

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-29086

GHSA-5PQ2-9X2X-5P6W

Affected Products

Hono

References · 177

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29086.json · Exploit
• https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073 · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://osv.dev/vulnerability/GHSA-5pq2-9x2x-5p6w · Vendor Advisory