CVE-2026-47675
4.3 MEDIUMHono is a Web application framework that provides support for any JavaScript runtime
Published: 2026-05-28 · Last updated: 2026-05-29
Severity and scoring
- CVSS
- 4.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CWE
- CWE-113, CWE-1287
Affected products
| Vendor | Product |
|---|---|
| hono | hono |
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.
Source: NVD
References
Related CVEs
Same vendor
- CVE-2026-47676 — Hono is a Web application framework that provides support for any JavaScript runtime (5.3 MEDIUM)
- CVE-2026-47674 — Hono is a Web application framework that provides support for any JavaScript runtime (5.3 MEDIUM)
- CVE-2026-47673 — Hono is a Web application framework that provides support for any JavaScript runtime (4.8 MEDIUM)
Same CWE
- CVE-2026-9753 — The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to re... (8.1 HIGH)
- CVE-2026-9742 — When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" ... (7.5 HIGH)
- CVE-2026-43966 — Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HT...
- CVE-2026-11460 — A flaw has been found in Boost Serialization up to 1.91 (7.3 HIGH)
- CVE-2024-6858 — In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL c... (6.5 MEDIUM)