The setCookie() utility in Hono did not escape semicolons, carriage returns, or newline characters present in the domain and path options. Because cookie attributes are separated by semicolons, an attacker can inject additional cookie attributes by supplying carefully crafted values in these fields, potentially allowing manipulation of cookie behavior such as setting custom flags, altering cookie names, or other unintended client-side state changes.

All versions of the Hono web application framework released by honojs prior to 4.12.4 are affected. The vulnerability is present in Node.js runtimes that use these older Hono releases.

The CVSS score of 5.4 places this issue in the moderate risk range, yet the EPSS of less than 1% suggests low current exploitation likelihood. It is not listed in the CISA KEV catalog. An attacker would typically need to supply a crafted domain or path value—often via a user-supplied request header or API parameter—to trigger the injection during a server's response construction.