CVE-2026-29086: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

March 4, 2026 (updated March 5, 2026)

The setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header.

Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields.

References

github.com/advisories/GHSA-5pq2-9x2x-5p6w
github.com/honojs/hono
github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073
github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w
nvd.nist.gov/vuln/detail/CVE-2026-29086

Code Behaviors & Features

Detect and mitigate CVE-2026-29086 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →