CVE-2026-47675: Hono Cookie Injection Vulnerability in sameSite and priority Parameters

Technical summary

CVE-2026-47675 affects Hono versions prior to 4.12.21. The serialize() function in hono/cookie inadequately sanitizes the sameSite and priority cookie options against characters that corrupt HTTP response header syntax (semicolon, carriage return, newline). The domain and path options are correctly validated, but sameSite and priority lack equivalent filtering. An attacker controlling input to these options can craft a malformed Set-Cookie header that includes attacker-specified cookie attributes. This represents a header injection vulnerability classified under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) and CWE-1287 (Improper Validation of Specified Type of Input).

Business impact

The vulnerability enables session manipulation and potential security policy bypass through cookie injection. While the CVSS score is moderate (4.3), the practical impact depends on application usage: if an app exposes sameSite or priority parameters to user input without additional validation, attackers could inject cookies with conflicting attributes, potentially affecting browser security policies (SameSite enforcement) or causing cache poisoning. The attack requires user interaction (reflected in the CVSS UI:R component), limiting but not eliminating risk in typical web deployment scenarios.

Affected systems

Hono versions prior to 4.12.21 are affected. Any JavaScript application using Hono's cookie serialization with user-controlled input passed to sameSite or priority parameters is vulnerable. This includes Node.js, Bun, Deno, and Cloudflare Workers deployments of Hono-based applications. Applications that hardcode these cookie options or sanitize user input separately are not affected.

Exploitability

Exploitability is straightforward but requires application-level exposure. An attacker must identify an application that accepts user input for sameSite or priority cookie options—a relatively uncommon pattern, as these are typically framework-controlled. The attack vector is network-based with low complexity. Exploitation does not require authentication or special privileges, but does require user interaction (typically clicking a malicious link or submitting a form). The attack surface is narrower than framework-wide vulnerabilities due to the specific requirement for user input handling.

Remediation

Upgrade Hono to version 4.12.21 or later. Organizations using earlier versions should prioritize this patch, particularly if cookie options are exposed to user input. Until patching is possible, implement input validation at the application level: reject or sanitize any user input destined for sameSite or priority parameters to remove or reject semicolons, carriage returns, and newlines.

Patch guidance

Apply Hono version 4.12.21 or later. Verify compatibility with your application's dependency chain and test in a staging environment before production deployment. Check your package.json or package management system for the current Hono version; if earlier than 4.12.21, update immediately. The patch adds proper input validation to sameSite and priority parameters, bringing them into alignment with existing domain and path sanitization.

Detection guidance

Monitor application logs for Set-Cookie headers containing unexpected or injected attributes, particularly those with anomalous sameSite or priority values containing special characters. Automated security scanning of dependencies should flag Hono versions earlier than 4.12.21. Application-level detection is challenging without instrumentation; focus detection efforts on identifying vulnerable versions in your inventory and validating that user input to cookie functions is restricted or properly sanitized.

Why prioritize this

Although CVSS 4.3 (MEDIUM) suggests lower urgency, prioritize based on application context. If your applications accept user input for cookie serialization options, treat this as higher priority despite the moderate score. The vulnerability requires no authentication and is network-accessible, making it a standing invitation for attackers to test exposed applications. Organizations with defense-in-depth practices (input validation, CSP, SameSite-by-default policies) face lower residual risk but should still patch promptly to eliminate the vector.

Risk score, explained

CVSS 4.3 reflects: network-based attack vector, low attack complexity, no privilege requirement, and user interaction needed. Confidentiality is not impacted (C:N), integrity is limited (I:L) due to cookie attribute injection rather than sensitive data exposure, and availability is unaffected (A:N). The score appropriately reflects a targeted injection vulnerability with moderate but real business risk—not a critical flaw, but a clear security gap that should not be ignored in typical web environments.

Frequently asked questions