{"id":"EUVD-2026-32925","enisaUuid":"05379e2b-c2b9-3384-b651-a4733a054d87","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.","datePublished":"May 28, 2026, 3:28:23 PM","dateUpdated":"May 28, 2026, 7:17:17 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x\n","aliases":"CVE-2026-47675\nGHSA-3hrh-pfw6-9m5x\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"8a58b179-0707-397d-85d4-927e027b55d7","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.21"}],"enisaIdVendor":[{"id":"c3f67299-49fd-382f-95ae-f3a9d494e6bb","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"45549ba6-9b71-3d4e-a533-eaf9433cd09f","vulnerability":{"id":"GHSA-3hrh-pfw6-9m5x","description":"Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection","datePublished":"Jun 4, 2026, 5:59:25 PM","dateUpdated":"Jun 4, 2026, 5:59:25 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47675\nhttps://github.com/honojs/hono/commit/905aedbc20661e0e2fa378783a7ec44a5c3df43d\nhttps://github.com/honojs/hono\nhttps://github.com/honojs/hono/releases/tag/v4.12.21\n","enisa_id":"EUVD-2026-32925\n","aliases":"CVE-2026-47675\nGHSA-3hrh-pfw6-9m5x\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"81097e89-ff59-3a3e-8a45-b2877516b610","vulnerability":{"id":"CVE-2026-47675","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.","datePublished":"May 28, 2026, 3:28:23 PM","dateUpdated":"May 28, 2026, 7:17:17 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x\n","enisa_id":"EUVD-2026-32925\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 3, 2026, 7:18:07 AM","vulnerabilityProduct":[{"id":"b0c928a1-2f18-3bfd-89e0-0298229529b5","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.21"}],"vulnerabilityVendor":[{"id":"09cb8adb-6395-3de9-bac4-00998983584d","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}