A bug in Hono's cookie parsing allows cookies whose names begin with a non‑breaking space to be normalized to match a legitimate cookie key. The framework therefore treats the attacker‑controlled cookie as equivalent to a valid cookie, enabling the attacker to substitute the value of a legitimate cookie. This issue corresponds to CWE‑20, Input Validation, but no additional weakness information is available from NVD.

The Hono framework (honojs:hono) is affected in all versions earlier than 4.12.12. Any application that incorporates that version is vulnerable.

The CVSS score of 4.8 indicates a moderate severity risk. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack scenario, inferred from the description, requires the attacker to send an HTTP request that contains a cookie with a leading non‑breaking space character. This could be achieved by a malicious web page that sets such a cookie or by modifying traffic on the network. The attacker can then overwrite the value of a legitimate cookie, potentially impacting the application state.