4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39410

CVE-2026-39410: Hono has a non-breaking space prefix bypass in cookie name handling in getCookie()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39410

CVE-2026-39410:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.12	4.12.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the parse function within src/utils/cookie.ts of the Hono.js framework. The core of the issue is the use of JavaScript's String.prototype.trim() method on cookie names. This method removes a wide range of whitespace characters, including the non-breaking space (U+00A0). Browsers, however, adhere to a stricter standard (RFC 6265bis) and only trim standard spaces (0x20) and horizontal tabs (0x09) from cookie names.

This discrepancy allows an attacker to create a cookie with a name prefixed with a non-breaking space (e.g., "\u00a0__Host-session"). The browser would treat this as a distinct cookie from "__Host-session". However, when the hono application processes the cookie string using the parse function, the trim() method would strip the U+00A0 prefix, causing the malicious cookie to be identified as "__Host-session". This would lead to the malicious cookie's value overriding the legitimate one, bypassing cookie prefix protections (__Host- and __Secure-) and potentially leading to session fixation or hijacking.

The patch addresses this by replacing trim() with a new, stricter trimCookieWhitespace function that only removes spaces and tabs, aligning the server-side parsing behavior with that of browsers. The parseSigned function was also affected as it likely relies on parse for initial cookie processing.

Vulnerable functions

parse

src/utils/cookie.ts

The `parse` function used `trim()` on cookie names, which removes a broader set of whitespace characters (including non-breaking spaces `U+00A0`) than what is specified in the cookie standards that browsers follow. This discrepancy could be exploited by an attacker to craft a malicious cookie (e.g., with a `U+00A0` prefix) that would be normalized by `parse` to the same name as a legitimate, security-sensitive cookie, effectively overriding it. This could lead to bypassing security mechanisms like `__Secure-` and `__Host-` prefixes, and potentially session fixation.

parseSigned

src/utils/cookie.ts

The `parseSigned` function was also vulnerable, as indicated by the new test cases added in the patch. It likely uses the `parse` function internally to handle the cookie string before verifying the signature. Therefore, it was susceptible to the same cookie name normalization vulnerability, allowing an attacker to override signed cookies.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.