CVE-2026-29086: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29086 is a cookie attribute injection vulnerability in the Hono Web application framework affecting all versions prior to 4.12.4. The setCookie() utility failed to validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header, enabling injection of additional cookie attributes when untrusted input is passed to these fields. The vulnerability was disclosed on March 3, 2026, and patched in version 4.12.4. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Hono Security Advisory).

The root cause is improper neutralization of CRLF sequences in HTTP headers (CWE-113), as setCookie() built the Set-Cookie header by concatenating option values without sanitizing the domain and path fields. While the cookie value itself was URL-encoded, these options were interpolated directly, allowing characters such as ;, \r, and \n to be included. Because cookie attributes are semicolon-delimited, an attacker who can influence the domain or path parameters can inject additional attributes — such as SameSite, Secure, Domain, or Path — into the resulting header. Modern JavaScript runtimes prevent full CRLF header injection, so the impact is limited to attribute-level manipulation within a single Set-Cookie header. The fix, applied in commit 44ae0c8, adds a validation check that throws an error if these characters are detected in either field (Hono Security Advisory, Patch Commit).

Successful exploitation allows an attacker to manipulate cookie security attributes — such as overriding SameSite, Secure, Domain, or Path — potentially weakening cookie scoping or bypassing browser-enforced security protections. This could expose session cookies to unintended origins or strip security flags, leading to limited confidentiality and integrity impacts. Availability is not affected, and exploitation requires both application-level misuse (passing user-controlled input into domain or path) and user interaction (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04% (13th percentile), indicating a low near-term exploitation probability. Exploitation requires an application to pass user-controlled input directly into the domain or path options of setCookie(), which is an application-level misuse condition (GitHub Advisory).

1. Identify a vulnerable target: Locate a Hono-based application (npm package hono < 4.12.4) that passes user-controlled input into the domain or path parameter of setCookie().
2. Craft a malicious input: Prepare a payload containing a semicolon followed by a desired cookie attribute, e.g., example.com; SameSite=None for the domain field, or /path; Secure for the path field.
3. Deliver the payload: Submit the crafted input through the application's interface (e.g., a form field, URL parameter, or API request) that feeds into the setCookie() call.
4. Trigger cookie issuance: Cause the server to issue a Set-Cookie header using the injected value, resulting in a header such as Set-Cookie: session=abc; Domain=example.com; SameSite=None where the attacker controls the injected attribute.
5. Achieve objective: Depending on the injected attribute, the attacker may broaden cookie scope (e.g., remove Secure flag, change SameSite policy) to facilitate session hijacking or cross-site request forgery in the victim's browser (Hono Security Advisory).

• Network: HTTP responses containing Set-Cookie headers with unexpected or duplicated attributes (e.g., multiple SameSite, Secure, or Domain directives) that differ from the application's intended cookie configuration.
• Logs: Server-side application logs showing unusual values in domain or path cookie parameters, particularly those containing semicolons, %3B, %0D, or %0A characters.
• Application Behavior: Unexpected cookie attribute changes observed in browser developer tools, such as cookies missing the Secure flag or having an unexpectedly broad Domain scope.

Upgrade the Hono npm package to version 4.12.4 or later, which rejects any domain or path values containing ;, \r, or \n characters by throwing an error at serialization time. As a workaround for applications that cannot immediately upgrade, developers should sanitize or validate user-controlled input before passing it into the domain or path options of setCookie(). IBM has also released patches for affected products including IBM DevOps Solution Workbench, IBM API Connect, and IBM watsonx Orchestrate that bundle the fixed Hono version (Hono Security Advisory, IBM DevOps Advisory, IBM API Connect Advisory).

The vulnerability was reported by security researcher TarPeg007 and published by Hono maintainer yusukebe on March 3, 2026. No significant broader media coverage or notable community debate has been identified beyond standard advisory distribution across vulnerability databases and scanner platforms such as Qualys (Hono Security Advisory).