EUVD-2026-38326
GHSA-j6c9-x7qj-28xf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible encoding flaw requiring no authentication; integrity impact is limited to cookie delivery corruption with no confidentiality or availability consequence.
Primary rating from Vendor (https://github.com/honojs/hono).
CVSS VectorVendor: https://github.com/honojs/hono
Lifecycle Timeline
2Blast Radius
ecosystem impact- 58 npm packages depend on hono (42 direct, 17 indirect)
Ecosystem-wide dependent count for version 4.12.25.
DescriptionCVE.org
Summary
On AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them.
Details
Per RFC 6265, each cookie must be its own Set-Cookie header line, and commas may appear inside attribute values. Joining cookies with ", " collides with those commas, producing a value that clients cannot reliably split. Only ALB single-header mode and VPC Lattice v2 are affected; API Gateway v1/v2 and ALB with multi-value headers enabled already use an array and are unaffected.
Impact
A client may receive only one of the cookies, a malformed cookie, or none. Session, CSRF, or preference cookies can silently fail to apply, breaking sessions or forcing re-authentication. This affects applications that set multiple cookies per response and run on AWS Lambda behind an ALB in single-header mode (the default) or VPC Lattice v2.
AnalysisAI
Cookie integrity failure in the Hono AWS Lambda adapter (npm/hono < 4.12.25) causes multiple Set-Cookie response headers to be merged into a single comma-separated value, violating RFC 6265 and producing unparseable cookie strings on ALB single-header mode (the default deployment) and VPC Lattice v2. Applications setting more than one cookie per response - including session tokens and CSRF cookies - will find those cookies silently dropped or misparsed by clients, potentially breaking authentication flows or defeating CSRF protections without any visible server-side error. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the defect is deterministic and triggers automatically on any multi-cookie response in affected deployments.
Technical ContextAI
The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output): the Hono AWS Lambda adapter serializes HTTP response headers by joining multiple Set-Cookie values with a comma-space delimiter, mirroring how generic multi-value HTTP headers are sometimes folded. However, RFC 6265 explicitly prohibits this for Set-Cookie because commas are valid characters within cookie attribute values - most notably in Expires dates (e.g., 'Expires=Thu, 01 Jan 2026 00:00:00 GMT'). A client receiving the merged single-header value cannot determine where one cookie definition ends and the next begins, leading to cookie loss or misparsing. The affected package is pkg:npm/hono, versions prior to 4.12.25. The defect is isolated to two AWS Lambda response paths: ALB single-header mode (the AWS default when multi-value headers are not explicitly enabled on the target group) and VPC Lattice v2 response format. API Gateway v1/v2 and ALB with multi-value headers already deliver Set-Cookie as a proper array and are structurally unaffected.
RemediationAI
Upgrade Hono to version 4.12.25 or later; this is the vendor-confirmed fix per the GitHub Security Advisory GHSA-j6c9-x7qj-28xf (https://github.com/honojs/hono/security/advisories/GHSA-j6c9-x7qj-28xf). For deployments that cannot upgrade immediately, enabling multi-value headers on the AWS ALB target group bypasses the defective code path entirely, as Hono correctly handles the array-based header format - this requires an AWS console or infrastructure-as-code configuration change and should be tested for compatibility with other header processing logic in the pipeline. As a narrower application-level workaround, reducing each response to a single Set-Cookie header eliminates the merge defect, but this is impractical for applications managing session and CSRF cookies independently and is not a recommended long-term approach. No other confirmed workarounds are available for VPC Lattice v2 deployments short of upgrading.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allShare
External POC / Exploit Code
Leaving vuln.today