5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54287

CVE-2026-54287: hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54287

CVE-2026-54287:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.25	4.12.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the AWS Lambda adapter of the Hono framework, specifically in how it handles responses that contain multiple Set-Cookie headers for AWS Application Load Balancer (ALB) in single-header mode and for AWS VPC Lattice v2. The root cause is the incorrect serialization of multiple cookie strings into a single Set-Cookie header by joining them with a comma. This violates RFC 6265, which mandates that each cookie must be in its own Set-Cookie header. The comma-joining strategy is problematic because the syntax for cookie attributes (e.g., the Expires attribute) can itself contain commas, leading to ambiguity and parsing failures on the client-side.

The analysis of the patch in commit 7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1 clearly identifies the two vulnerable functions. In src/adapter/aws-lambda/handler.ts, both ALBProcessor.setCookiesToResult and LatticeV2Processor.setCookiesToResult contained the flawed cookies.join(', ') logic. The patch corrects this by changing the logic to handle cookies correctly for each specific environment. For ALB in single-header mode, it now sends only the first cookie to prevent creating an invalid header. For Lattice v2, it passes the array of cookies to be processed into multiple headers. An engineer with this CVE in their environment should update to the patched version of Hono to ensure that cookies are set correctly when deploying on the affected AWS services.

Vulnerable functions

ALBProcessor.setCookiesToResult

src/adapter/aws-lambda/handler.ts

This function is responsible for setting cookies in the response for AWS ALB. The vulnerable version of the code incorrectly joined multiple cookie strings with a comma, which is not compliant with RFC 6265 and causes parsing issues in browsers, as cookie attributes like 'Expires' can contain commas. This could lead to cookies being dropped or misinterpreted, affecting session management.

LatticeV2Processor.setCookiesToResult

src/adapter/aws-lambda/handler.ts

This function is responsible for setting cookies in the response for AWS VPC Lattice v2. The vulnerable version of the code incorrectly joined multiple cookie strings with a comma. The fix passes the cookie array directly, allowing the environment to create proper multiple 'Set-Cookie' headers, thus resolving the parsing issue on the client side.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.