CVE-2026-29086

CVE-2026-29086 describes a vulnerability in the Hono web application framework, affecting versions prior to 4.12.4. The setCookie() utility failed to properly sanitize semicolons, carriage returns, and newline characters in the domain and path options, enabling injection of additional cookie attributes if untrusted input was used. This medium-severity vulnerability has a CVSS score of 5.4, indicating a network-based attack with low complexity requiring user interaction, potentially leading to limited confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.