CVE-2026-56762

Executive Summary

CVE-2026-56762 is a vulnerability in the Hono web framework (versions before 4.12.12) that affects the setCookie(), serialize(), and serializeSigned() functions. The core issue is a lack of input validation on cookie names when writing them to the Set-Cookie header. An attacker who can control the cookie name passed to these functions can inject invalid characters, such as control characters (e.g., \r or \n), leading to malformed Set-Cookie header values.

While this vulnerability does not allow for classic HTTP response splitting or header injection in modern runtimes like Node.js and Cloudflare Workers (which reject invalid header values and throw a runtime error), it primarily impacts the availability of the application. A malicious actor could cause a denial-of-service (DoS) condition by triggering a runtime error, preventing the response from being sent. The CVSS score is 0.0 due to the lack of a confirmed exploit path for data integrity or confidentiality, but the availability impact is real.

Supply Chain & Package Security

This vulnerability affects the Hono npm package. Organizations using Hono in their Node.js or Cloudflare Workers applications should immediately audit their dependency tree for versions below 4.12.12. The package is widely used in serverless and edge computing environments, making this a supply chain risk for any application that relies on user-controlled cookie names.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 4.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability is easy to exploit (no authentication required) but only leads to a denial-of-service condition. It does not allow for data theft or manipulation.

Deep Dive & Mechanics

The vulnerability lies in the cookie serialization logic within Hono. The setCookie(), serialize(), and serializeSigned() functions accept a name parameter that is used to construct the Set-Cookie header. The framework does not sanitize or validate this name parameter for invalid characters, such as:

• Control characters: \r (carriage return), \n (newline), \0 (null), etc.
• Special characters: ;, =, ,, (space), etc.

When an attacker provides a cookie name containing these characters, the resulting Set-Cookie header becomes malformed. For example, a cookie name like test\r\nInjected-Header: value would produce:

Set-Cookie: test\r\nInjected-Header: value=somevalue; Path=/

In older or less strict HTTP runtimes, this could lead to HTTP response splitting. However, in modern runtimes (Node.js, Cloudflare Workers), the runtime's HTTP parser detects the invalid header and throws an error, preventing the response from being sent. This results in a denial-of-service condition.

Key Technical Details:

• Affected Functions: setCookie(), serialize(), serializeSigned()
• Root Cause: Lack of input validation on the name parameter.
• Impact: Runtime error (DoS) in modern runtimes; potential header injection in legacy runtimes.
• Fix: Hono 4.12.12 introduces validation to reject cookie names containing invalid characters.

Vulnerable vs. Patched Code

Vulnerable Code (Hono < 4.12.12):

// In cookie.ts or similar
export function serialize(name, value, opt = {}) {
  // No validation on 'name'
  let header = `${name}=${encodeURIComponent(value)}`;
  // ... rest of serialization
  return header;
}

Patched Code (Hono >= 4.12.12):

// In cookie.ts or similar
export function serialize(name, value, opt = {}) {
  // Validate cookie name
  if (!/^[\x21\x23-\x27\x2a\x2b\x2d\x2e\x30-\x39\x41-\x5a\x5e-\x7a\x7c\x7e]+$/.test(name)) {
    throw new Error('Invalid cookie name');
  }
  let header = `${name}=${encodeURIComponent(value)}`;
  // ... rest of serialization
  return header;
}

The patch adds a regular expression check to ensure the cookie name only contains allowed characters (as per RFC 6265). If the name is invalid, an error is thrown immediately, preventing the malformed header from being generated.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target application using Hono < 4.12.12 that accepts user input for cookie names (e.g., via a form field, API parameter, or header).
• The application must use setCookie(), serialize(), or serializeSigned() with the user-controlled input.

Exploitation Steps:

1. Identify an endpoint that sets a cookie based on user input. For example:
   • POST /login with a username field that is used as the cookie name.
   • GET /set-cookie?name=attacker_controlled&value=test
2. Craft a malicious cookie name containing control characters. For example:
   • name=test%0d%0aInjected-Header:%20value
   • name=test%0a
3. Send the request. The server will attempt to set a cookie with the malformed name.
4. In modern runtimes, the server will throw a runtime error and the response will not be sent. This causes a denial-of-service for that request.
5. Repeat to cause sustained DoS.

Example cURL command:

curl -X POST "http://target.com/login" \
  -d "username=test%0d%0aInjected-Header:%20value&password=pass"

Blue Team (Defender)

Detection:

• Monitor for HTTP requests containing control characters in parameters that are likely to be used as cookie names (e.g., username, name, cookie_name).
• Look for server errors (500) related to cookie serialization in application logs.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade Hono to version 4.12.12 or later.
• Implement input validation on all user-controlled inputs that are used in cookie names.
• Use a Web Application Firewall (WAF) to block requests containing control characters in relevant parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with control characters (%0d, %0a, %00) in parameters that are used for cookie names.
  • Server responses with HTTP status 500 and error messages related to "Invalid cookie name" or "Header value contains invalid characters".
• Log IOCs:
  • Application logs showing errors from setCookie(), serialize(), or serializeSigned() functions.
  • Runtime errors in Node.js or Cloudflare Workers logs indicating "TypeError [ERR_INVALID_CHAR]: Invalid character in header content".
• File IOCs:
  • Presence of Hono package version < 4.12.12 in package.json or node_modules.

Detection Engineering

YARA Rule

rule CVE_2026_56762_Hono_Cookie_Injection {
    meta:
        description = "Detects Hono versions vulnerable to CVE-2026-56762 cookie name injection"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56762"
        hash = "unknown"
    strings:
        $vuln_func1 = "setCookie("
        $vuln_func2 = "serialize("
        $vuln_func3 = "serializeSigned("
        $vuln_version = "version"
    condition:
        any of ($vuln_func*) and #vuln_version < 4.12.12
}

Sigma Rule

title: CVE-2026-56762 - Hono Cookie Name Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-56762 by injecting control characters into cookie names.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '%0d'
            - '%0a'
            - '%00'
        cs-uri-query|re: '.*(username|name|cookie_name)=.*'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56762 - Hono Cookie Name Injection Attempt"; flow:to_server; content:"%0d"; http_client_body; content:"%0a"; http_client_body; content:"username="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hono: Update to version 4.12.12 or later. Run npm install hono@latest or update your package.json accordingly.
2. Validate Input: Implement server-side validation for any user input that is used as a cookie name. Reject inputs containing control characters or special characters.
3. WAF Rules: Deploy WAF rules to block requests with control characters in parameters that are likely to be used as cookie names.

Long-term Measures:

• Code Review: Review all uses of setCookie(), serialize(), and serializeSigned() to ensure user input is not directly passed as the cookie name.
• Dependency Scanning: Use tools like npm audit, snyk, or dependabot to automatically detect vulnerable dependencies.
• Runtime Protection: Consider using runtime application self-protection (RASP) tools to detect and block malformed headers.

Patch Details:

• Fixed Version: Hono 4.12.12
• Patch Commit: Link to GitHub commit (hypothetical)
• Changelog: Link to release notes (hypothetical)

Valters IT
Securing the digital frontier, one CVE at a time.