CVE-2026-29086

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie...

CVE-2026-29086

In IBM advisories, CVE-2026-29086 affects the Hono web framework used by IBM App Connect Enterprise containers. Prior to 4.12.4, setCookie() did not validate semicolons, carriage returns, or newlines in domain and path when constructing Set-Cookie, enabling potential cookie-attribute injection. T...

CVE-2026-29086 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie...

CVE-2026-29086 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie utility did not validate semicolons ;, carriage returns \r, or newline characters \n in the domain and path options when constructing the Set-Cookie header. Because cookie...

Improper Handling of URL Encoding (Hex Encoding)

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +207 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: OSV:GHSA-WC8C-QW6V-H7F6...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +207 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: SNYK:JS-HONONODESERVER-15425963...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29086 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29086 Source advisory: OSV:GHSA-5PQ2-9X2X-5P6W...

EUVD-2026-9508

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie...

EUVD-2026-9507

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29085 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29085 Source advisory: OSV:GHSA-P6XX-57QC-3WXR...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29045 +1 more via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29045, CVE-2026-6414 Source advisory: OSV:GHSA-Q5QW-H33P-QVWR...

EUVD-2026-9506

Hono vulnerable to arbitrary file access via serveStatic vulnerability...

Hono 注入漏洞

Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 had an injection vulnerability. This vulnerability stemmed from the streamSSE function not verifying carriage returns or line feeds in event, ID, and retry fields, which could lead to the...

Hono 安全漏洞

Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 contained security vulnerabilities. These vulnerabilities stemmed from inconsistent URL decoding when using serveStatic and routing-based middleware protections. This allowed paths containing...

Hono 安全漏洞

Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 contained security vulnerabilities. These vulnerabilities stemmed from the setCookie tool, which did not validate the semicolons, line breaks, or newlines in the domain and path parameters when...

PT-2026-23076

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4 Description Hono is a Web application framework supporting various JavaScript runtimes. A flaw exists where the event, id, and retry fields within the streamSSE function in the Streaming Helper were not properly...

PT-2026-23077

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4 Description The setCookie utility did not properly validate semicolons ;, carriage returns r, or newline characters in the domain and path options when creating the Set-Cookie header. Because cookie attributes are...

PT-2026-23075

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4 Description Hono is a Web application framework supporting various JavaScript runtimes. An inconsistency in URL decoding between the router decodeURI and serveStatic decodeURIComponent allowed protected static...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality (CVE-2026-24398, CVE-2026-24472, CVE-2026-24473, CVE-2026-24771)

Summary Node.js module Hono is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported...