Hono CVE-2026-56762

Exploitation requires that the Hono application explicitly passes user-controlled (untrusted) input as the cookie name argument to setCookie(), serialize(), or serializeSigned(). This is not a default framework behavior - it requires an application design decision to use dynamic, user-supplied cookie names rather than static, developer-defined names. Most Hono applications use static cookie names and are not affected in practice. The attack is further limited by runtime behavior: Node.js and Cloudflare Workers both reject malformed header values before transmission, restricting confirmed impact to runtime errors (availability) rather than header injection. Exploitation for header injection or response splitting would require a runtime that does not validate Set-Cookie header values, which was not demonstrated in the vendor's testing. No authentication is required to reach the vulnerable code path if the application exposes an unauthenticated endpoint that uses dynamic cookie names.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.9, reflecting network reachability with no authentication requirement and low availability impact - appropriately calibrated given that confirmed runtime behavior produces errors rather than data exposure. The integrity metrics (VI:N/SI:N) are set to None, consistent with the vendor's finding that header injection could not be reproduced in Node.js or Cloudflare Workers. No EPSS data was provided in the source intelligence. There is no CISA KEV listing and no public exploit code, making this a low-urgency issue despite the network-reachable attack vector. The primary real-world risk is an availability disruption: endpoints that accept untrusted cookie names will throw runtime exceptions and fail to send responses, which could be triggered by a remote unauthenticated attacker if the application exposes such functionality. The theoretical response-splitting risk (which the CWE classification implies) is substantially mitigated by modern runtime protections. The gap between the CVSS classification and confirmed exploitability is notable - defenders should treat this as a correctness/robustness fix rather than an active exploitation risk.

An attacker sends an HTTP request to a Hono-based endpoint that reflects or accepts user input as a cookie name - for example, a session personalization feature that stores a user-supplied preference name as a cookie. By injecting a value containing \r\n (CRLF) characters in the cookie name field, the attacker causes setCookie() to generate a malformed Set-Cookie header. On Node.js or Cloudflare Workers, the runtime rejects the header and the response handler throws an uncaught exception, resulting in a failed response (availability impact). On a hypothetical runtime without strict header validation, the malformed header could produce a secondary injected header in the HTTP response.