CVE-2026-39410
Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.
| CWE | CWE-20 |
| Vendor | honojs |
| Product | hono |
| Published | Apr 8, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for honojs hono
Be the first to know when new medium vulnerabilities affecting honojs hono are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
honojs / hono
< 4.12.12