The Hono web framework’s serialize() function validates the domain and path options of cookies against characters that would corrupt the Set‑Cookie header syntax, but it does not validate the sameSite and priority options. When user‑controlled input is used for these options, an attacker can influence the Set‑Cookie header to include custom attributes. The attacker can set arbitrary cookie attributes such as SameSite, Secure, HttpOnly or other options, which may affect the security of user sessions. The impact is that an attacker can alter or forge cookie settings for requests to the application.

Users of the Hono framework (vendor honojs:hono) with versions older than 4.12.21 are affected. The vulnerability exists in the cookie serialization routine shipped with Hono before version 4.12.21. Upgrading to 4.12.21 or later fixes the flaw.

With a CVSS score of 4.3 the vulnerability is considered moderate. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker submitting crafted input that becomes part of the sameSite or priority cookie option, resulting in a manipulated Set‑Cookie header in the HTTP response. No additional prerequisites are mentioned in the advisory, so exploitation would rely primarily on the ability to influence cookie option values through legitimate application input.