Skip to content

Commit de7aebb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5pq2-9x2x-5p6w GHSA-p6xx-57qc-3wxr GHSA-q5qw-h33p-qvwr
1 parent d29a9b1 commit de7aebb

3 files changed

Lines changed: 183 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-5pq2-9x2x-5p6w/GHSA-5pq2-9x2x-5p6w.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5pq2-9x2x-5p6w",
4+
"modified": "2026-03-04T19:49:14Z",
5+
"published": "2026-03-04T19:49:14Z",
6+
"aliases": [
7+
"CVE-2026-29086"
8+
],
9+
"summary": "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
10+
"details": "## Summary\n\nThe `setCookie()` utility did not validate semicolons (`;`), carriage returns (`\\r`), or newline characters (`\\n`) in the `domain` and `path` options when constructing the `Set-Cookie` header.\n\nBecause cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields.\n\n## Details\n\n`setCookie()` builds the `Set-Cookie` header by concatenating option values. While the cookie value itself is URL-encoded, the `domain` and `path` options were previously interpolated without rejecting unsafe characters.\n\nIncluding `;`, `\\r`, or `\\n` in these fields could result in unintended additional attributes (such as `SameSite`, `Secure`, `Domain`, or `Path`) being appended to the cookie header.\n\nModern runtimes prevent full header injection via CRLF, so this issue is limited to attribute-level manipulation within a single `Set-Cookie` header.\n\nThe issue has been fixed by rejecting these characters in the `domain` and `path` options.\n\n## Impact\n\nAn attacker may be able to manipulate cookie attributes if an application passes user-controlled input directly into the `domain` or `path` options of `setCookie()`.\n\nThis could affect cookie scoping or security attributes depending on browser behavior. Exploitation requires application-level misuse of cookie options.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "hono"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.12.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/honojs/hono"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-113"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-04T19:49:14Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-p6xx-57qc-3wxr/GHSA-p6xx-57qc-3wxr.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p6xx-57qc-3wxr",
4+
"modified": "2026-03-04T19:48:42Z",
5+
"published": "2026-03-04T19:48:41Z",
6+
"aliases": [
7+
"CVE-2026-29085"
8+
],
9+
"summary": "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()",
10+
"details": "## Summary\n\nWhen using `streamSSE()` in Streaming Helper, the `event`, `id`, and `retry` fields were not validated for carriage return (`\\r`) or newline (`\\n`) characters.\n\nBecause the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields.\n\n## Details\n\nThe SSE helper builds event frames by joining lines with `\\n`. While multi-line `data:` fields are handled according to the SSE specification, the `event`, `id`, and `retry` fields previously allowed raw values without rejecting embedded CR/LF characters.\n\nIncluding CR/LF in these control fields could allow unintended additional fields (such as `data:`, `id:`, or `retry:`) to be injected into the event stream.\n\nThe issue has been fixed by rejecting CR/LF characters in these fields.\n\n## Impact\n\nAn attacker could manipulate the structure of SSE event frames if an application passed user-controlled input directly into `event`, `id`, or `retry`.\n\nDepending on application behavior, this could result in injected SSE fields or altered event stream handling. Applications that render `e.data` in an unsafe manner (for example, using `innerHTML`) could potentially expose themselves to client-side script injection.\n\nThis issue affects applications that rely on the SSE helper to enforce protocol-level constraints.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "hono"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.12.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/honojs/hono"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-74"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-04T19:48:41Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-q5qw-h33p-qvwr/GHSA-q5qw-h33p-qvwr.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q5qw-h33p-qvwr",
4+
"modified": "2026-03-04T19:48:00Z",
5+
"published": "2026-03-04T19:48:00Z",
6+
"aliases": [
7+
"CVE-2026-29045"
8+
],
9+
"summary": "Hono vulnerable to arbitrary file access via serveStatic vulnerability ",
10+
"details": "## Summary\n\nWhen using `serveStatic` together with route-based middleware protections (e.g. `app.use('/admin/*', ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.\n\nThe router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.\n\n\n## Details\n\nThe routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.\n\nExample:\n\nRequest: `/admin%2Fsecret.html`\n\n- Router sees: `/admin%2Fsecret.html` → does not match `/admin/*`\n- Static handler resolves: `/admin/secret.html`\n\nAs a result, static files under the configured static root could be served without triggering route-based protections.\n\nThis only affects applications that both:\n\n- Protect subpaths using route-based middleware, and\n- Serve files from the same static root using `serveStatic`.\n\nThis does **not** allow access outside the static root and is **not** a path traversal vulnerability.\n\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths may have exposed those resources.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "hono"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.12.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/honojs/hono"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-177"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-04T19:48:00Z",
59+
"nvd_published_at": null
60+
}
61+
}

0 commit comments

Comments
 (0)