{"action":"Upgrade hono to 4.12.12 or later.","affected":[{"fixed":"4.12.12","introduced":"0"}],"component":"hono","cve_ids":["CVE-2026-56762"],"ecosystem":"npm","epss":0.00418,"exploited":false,"fixed_versions":["4.12.12"],"ghsa_id":"GHSA-26pp-8wgv-hjvm","id":"tcs_01M5KES4R587RW6CC89R4VF9KS","modified_at":"2026-09-24T18:45:10.903668809Z","published_at":"2026-04-08T00:17:02Z","references":["https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm","https://github.com/honojs/hono/security/advisories/GHSA-26pp-8wgv-hjvm","https://nvd.nist.gov/vuln/detail/CVE-2026-56762","https://github.com/honojs/hono/commit/a586cd72e3f6122792e631ecf1817e5cabb803ec","https://github.com/honojs/hono","https://github.com/honojs/hono/releases/tag/v4.12.12","https://www.vulncheck.com/advisories/hono-missing-cookie-name-validation-in-setcookie"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-26pp-8wgv-hjvm","url":"https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm"}],"summary":"Hono missing validation of cookie name on write path in setCookie()"}