CVE-2026-39410

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.

• CWE-20

• https://github.com/honojs/hono/commit/cc067c85592415cb1880ad3c61ed923472452ec0Third Party Advisory
• https://github.com/honojs/hono/releases/tag/v4.12.12Release Notes
• https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39405Frappe Learning Management System (LMS) is a learning system…9.4
• CVE-2026-39406@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-39409Hono is a Web application framework that provides support fo…5.3
• CVE-2026-3941Insufficient policy enforcement in DevTools in Google Chrome…4.3
• CVE-2026-39411LobeHub is a work-and-lifestyle space to find, build, and co…7.1
• CVE-2026-39412LiquidJS is a Shopify / GitHub Pages compatible template eng…7.5
• CVE-2026-39413LightRAG provides simple and fast retrieval-augmented genera…6.5
• CVE-2026-39414MinIO is a high-performance object storage system. From RELE…6.5
• CVE-2026-39415Frappe Learning Management System (LMS) is a learning system…4.3
• CVE-2026-39416AIL framework is an open-source platform to collect, crawl, …6.1