4.8
Medium
CVE-2026-39410 Hono is a Web application framework that provides support for any JavaScript runtime
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| hono 4.12 | earliest → < 4.12.12 | 4.12.12 |
Other CVEs of hono
The 48 CVEs of hono →
CVE-2026-111757
Hono is a Web application framework that provides support for any JavaScript runtime
5.3
Medium
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated…
6.9
Medium
CVE-2026-93981
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a…
2.3
Low
CVE-2026-84365
Hono is a Web application framework that provides support for any JavaScript runtime
6.5
Medium