https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:36:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322608 EUVD-2026-322608 https://cve.radiocsirt.org/vuln/euvd-2026-322608 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47675 <p>Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.</p> <p>Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed in 4.12.21.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47675 https://cve.radiocsirt.org/vuln/ghsa-3hrh-pfw6-9m5x <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>The `serialize()` function in `hono/cookie` validates `domain` and `path` options against characters that corrupt `Set-Cookie` header syntax (`;`, `\r`, `\n`), but does not apply the same validation to `sameSite` and `priority`. An application that passes user-controlled input into either option may produce a `Set-Cookie` response header containing attacker-chosen additional attributes.</p> <p>### Details</p> <p>When constructing a `Set-Cookie` header value, `serialize()` appends the `sameSite` and `priority` option values directly into the output string after a presentation-only transformation (capitalizing the first character). Although the TypeScript type signature constrains these options to specific string literals, that constraint is not enforced at runtime; any string value, including one containing `;` or line-feed characters, passes through unchanged.</p> <p>The validation guard that rejects `;`, `\r`, and `\n` from `domain` and `path` is not applied to `sameSite` or `priority`. An application that passes a request-derived value to either option therefore provides an injection point into the header line.</p> <p>This issue arises when an application passes user-controlled input to the `sameSite` or `priority` option of `setCookie()` or `serialize()`.</p> <p>### Impact</p> <p>An attacker who can control the `sameSite` or `priority` option value may inject additional attributes into a `Set-Cookie` response header.</p> <p>This may lead to:</p> <p>- Cookie attribute injection — overriding `Domain`, `Path`…</p> <p><strong>Affected:</strong> npm: hono</p> <p>### Summary</p> <p>The `serialize()` function in `hono/cookie` validates `domain` and `path` options against characters that corrupt `Set-Cookie` header syntax (`;`, `\r`, `\n`), but does not apply the same validation to `sameSite` and `priority`. An application that passes user-controlled input into either option may produce a `Set-Cookie` response header containing attacker-chosen additional attributes.</p> <p>### Details</p> <p>When constructing a `Set-Cookie` header value, `serialize()` appends the `sameSite` and `priority` option values directly into the output string after a presentation-only transformation (capitalizing the first character). Although the TypeScript type signature constrains these options to specific string literals, that constraint is not enforced at runtime; any string value, including one containing `;` or line-feed characters, passes through unchanged.</p> <p>The validation guard that rejects `;`, `\r`, and `\n` from `domain` and `path` is not applied to `sameSite` or `priority`. An application that passes a request-derived value to either option therefore provides an injection point into the header line.</p> <p>This issue arises when an application passes user-controlled input to the `sameSite` or `priority` option of `setCookie()` or `serialize()`.</p> <p>### Impact</p> <p>An attacker who can control the `sameSite` or `priority` option value may inject additional attributes into a `Set-Cookie` response header.</p> <p>This may lead to:</p> <p>- Cookie attribute injection — overriding `Domain`, `Path`…</p> https://cve.radiocsirt.org/vuln/ghsa-3hrh-pfw6-9m5x