CVE-2026-39410
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Hono, a web framework supporting any JavaScript runtime, prior to version 4.12.12 has a vulnerability due to a discrepancy between browser cookie parsing and the parse() function, allowing cookie prefix protections to be bypassed and attacker-controlled cookies to override legitimate ones.
Risk Assessment
An attacker can override session cookies or other important cookies, potentially leading to session hijacking or other cookie manipulation attacks.
Recommendation
Update Hono to version 4.12.12 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.