Hono up to 4.12.11 Cookie Header setCookie response splitting

Summaryinfo

A vulnerability was found in Hono up to 4.12.11. It has been rated as problematic. This affects the function setCookie of the component Cookie Header Handler. Performing a manipulation results in response splitting. This vulnerability is reported as CVE-2026-56762. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Hono up to 4.12.11. This affects the function setCookie of the component Cookie Header Handler. The manipulation with an unknown input leads to a response splitting vulnerability. CWE is classifying the issue as CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. This is going to have an impact on availability. The summary by CVE is:

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g. \r or \n) when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie header values. In modern runtimes such as Node.js and Cloudflare Workers, such invalid header values are rejected and cause a runtime error before the response is sent, so header injection or response splitting could not be reproduced; the issue primarily affects correctness and robustness, resulting in runtime errors (availability) rather than confirmed header injection.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-56762 since 06/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 4.12.12 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Hono

Version

• 4.12.0
• 4.12.1
• 4.12.2
• 4.12.3
• 4.12.4
• 4.12.5
• 4.12.6
• 4.12.7
• 4.12.8
• 4.12.9
• 4.12.10
• 4.12.11

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion