5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29086

CVE-2026-29086: Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29086

CVE-2026-29086:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.4	4.12.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch 44ae0c8cc4d5ab2bed529127a4ac72e1483ad073 clearly indicates that the vulnerability lies within the _serialize function in the src/utils/cookie.ts file. The vulnerability, as described, is a cookie attribute injection flaw due to unsanitized domain and path parameters used in cookie creation. The patch introduces explicit validation for these parameters within the _serialize function by checking for semicolons, carriage returns, and newline characters. The presence of this fix directly points to _serialize as the function where the vulnerability existed. During exploitation, this function would be called to process the malicious input, making it the primary function that would appear in a runtime profile.

Vulnerable functions

_serialize

src/utils/cookie.ts

The vulnerability is in the `_serialize` function, which is responsible for creating the `Set-Cookie` header string. Before the patch, this function did not validate the `domain` and `path` options for malicious characters. An attacker could provide a specially crafted string with a semicolon, carriage return, or newline to inject additional cookie attributes, such as `SameSite` or `Secure`. The patch adds a check to ensure the `domain` and `path` values do not contain these characters, thus preventing the injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.