CVEvulnerability

CVE-2026-54287

5.3 MEDIUM Published 2026-06-22 Modified 2026-10-25 Official page ↗
Status
Deferred
Published
2026-06-22
Last modified
2026-10-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-116

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.

Related

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References