What is the CVSS score of CVE-2026-47675?

CVE-2026-47675 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47675?

Yes, a patch is available for CVE-2026-47675. Update the affected software to the latest version immediately.

Hono Framework CVE-2026-47675

EUVD-2026-32925 MEDIUM

HTTP Response Splitting (CWE-113)

2026-05-28 GitHub_M

GHSA-3hrh-pfw6-9m5x

Information Disclosure Hono

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:24 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on hono (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.12.21.

DescriptionGitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.

AnalysisAI

HTTP response header injection in Hono's cookie serialize() function allows unauthenticated remote attackers to inject arbitrary Set-Cookie attributes when an application passes user-controlled input into the sameSite or priority cookie options. All Hono releases prior to 4.12.21 are affected across every supported JavaScript runtime. No public exploit code exists at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network-accessible vector make it exploitable wherever the affected code path is reachable by user-supplied data.

Technical ContextAI

Hono is a lightweight, multi-runtime Web application framework (Node.js, Deno, Bun, Cloudflare Workers, etc.) identified by CPE cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*. Its hono/cookie module exposes a serialize() function for building Set-Cookie header values. The function performs input sanitization on the domain and path options, rejecting characters that break cookie syntax (semicolons, carriage returns, newlines), but applies no equivalent validation to the sameSite or priority options. This maps directly to CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), a class of HTTP response splitting/header injection flaws. An attacker who can influence either option value can terminate the intended attribute field early and append attacker-chosen directives - or in environments where newline injection is not separately blocked, inject entirely new headers - into the HTTP response.

RemediationAI

The primary remediation is to upgrade Hono to version 4.12.21 or later, which extends input validation to the sameSite and priority options in serialize(). This is a vendor-released patch confirmed by GitHub Security Advisory GHSA-3hrh-pfw6-9m5x. For applications unable to upgrade immediately, the effective compensating control is to sanitize or allowlist user-controlled input before passing it to the sameSite or priority cookie options - for example, accepting only the RFC-defined string literals ('Strict', 'Lax', 'None' for sameSite; 'High', 'Medium', 'Low' for priority) and rejecting all other values. This eliminates the injection surface without requiring a framework upgrade, though it places the validation burden on application code and may be missed in future refactors. Review all call sites of serialize() to audit whether any option values derive from external input. The full advisory is at https://github.com/honojs/hono/security/advisories/GHSA-3hrh-pfw6-9m5x.