CVE-2026-54287

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.25

Description On AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into a single comma-separated value. According to RFC 6265, each cookie must be its own header line. Since commas are valid characters within cookie attributes, such as Expires dates, clients are unable to correctly split the combined value back into individual cookies, leading to cookies being silently dropped or misparsed. This can result in the failure of session, CSRF, or preference cookies, potentially breaking user sessions or forcing re-authentication. This issue specifically affects applications running on AWS Lambda behind an ALB in single-header mode or VPC Lattice v2.

Recommendations Update to version 4.12.25.