Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e3g1-j76d-ebes
Vulnerability ID VCID-e3g1-j76d-ebes
Aliases CVE-2026-39410
GHSA-r5rp-j6wh-rvv4
Summary Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2026-39410
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-r5rp-j6wh-rvv4
cvssv3.1 4.8 https://github.com/honojs/hono
generic_textual MODERATE https://github.com/honojs/hono
cvssv3.1 4.8 https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
generic_textual MODERATE https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
ssvc Track https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
cvssv3.1 4.8 https://github.com/honojs/hono/releases/tag/v4.12.12
generic_textual MODERATE https://github.com/honojs/hono/releases/tag/v4.12.12
ssvc Track https://github.com/honojs/hono/releases/tag/v4.12.12
cvssv3.1 4.8 https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
cvssv3.1_qr MODERATE https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
generic_textual MODERATE https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
ssvc Track https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2026-39410
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-39410
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-39410
https://github.com/honojs/hono
https://nvd.nist.gov/vuln/detail/CVE-2026-39410
cc067c85592415cb1880ad3c61ed923472452ec0 https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
GHSA-r5rp-j6wh-rvv4 https://github.com/advisories/GHSA-r5rp-j6wh-rvv4
GHSA-r5rp-j6wh-rvv4 https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
v4.12.12 https://github.com/honojs/hono/releases/tag/v4.12.12
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/honojs/hono
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-08T15:17:07Z/ Found at https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/honojs/hono/releases/tag/v4.12.12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-08T15:17:07Z/ Found at https://github.com/honojs/hono/releases/tag/v4.12.12
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-08T15:17:07Z/ Found at https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-39410
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09166
EPSS Score 0.0003
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:45:54.644583+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39410.json 38.6.0