CVE-2026-56762

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12

Description The software fails to validate cookie names within the setCookie(), serialize(), and serializeSigned() functions. When an application uses a user-controlled cookie name, invalid characters such as control characters (e.g., r or ) can be included, leading to malformed Set-Cookie header values. In runtimes like Node.js and Cloudflare Workers, these invalid values are rejected, causing runtime errors that impact availability and robustness, although header injection and response splitting were not reproduced.

Recommendations Update to version 4.12.12 or later.