Description (CNA)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| honojs / hono | affected < 4.12.4 |
CWE
CWE-1113
References
- https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w
- https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073
ADP enrichment
No English description supplied.
No references supplied.