@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agentforce/adk (>=0.9.0, <=0.12.1) +650 more potentially affected by CVE-2026-47675 via hono (>=4.0.0, <=4.12.19)

hono NPM version =4.0.0, =0.3.1, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.2, =0.0.1-alpha.15 and more Source cves: CVE-2026-47675 Source advisory:...

CVE-2026-47675

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax ;, \r, \n, but does not apply the same validation to sameSite an...