Is hono affected by GHSA-26pp-8wgv-hjvm?

npm hono is affected in <4.12.12.

Is GHSA-26pp-8wgv-hjvm being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

medium

GHSA-26pp-8wgv-hjvm

Q: Is GHSA-26pp-8wgv-hjvm being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

npm · hono

Summary

Hono missing validation of cookie name on write path in setCookie()

Severity: medium
Published: 2026-04-08

References

https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm
https://github.com/honojs/hono/commit/a586cd72e3f6122792e631ecf1817e5cabb803ec
https://github.com/honojs/hono

Related advisories

CVE-2026-54290 — high · npm/hono
CVE-2026-54288 — medium · npm/hono
CVE-2026-54289 — medium · npm/hono
CVE-2026-54286 — medium · npm/hono
CVE-2026-54287 — medium · npm/hono
CVE-2026-47676 — medium · npm/hono
CVE-2026-47674 — medium · npm/hono
CVE-2026-47675 — medium · npm/hono

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.