CVE-2026-47675: Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

June 4, 2026

The serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes.

References

github.com/advisories/GHSA-3hrh-pfw6-9m5x
github.com/honojs/hono/commit/905aedbc20661e0e2fa378783a7ec44a5c3df43d
github.com/honojs/hono/releases/tag/v4.12.21
github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x
nvd.nist.gov/vuln/detail/CVE-2026-47675

Code Behaviors & Features

Detect and mitigate CVE-2026-47675 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →