The vulnerability arises from the absence of validation on cookie names in Hono's setCookie(), serialize(), and serializeSigned() functions. When a user supplies a name containing control characters such as carriage return or newline, the framework accepts it and constructs a malformed Set-Cookie header. Although modern runtimes reject such headers and throw a runtime error before the response is sent, the result is an availability disruption rather than a classic header injection. The weakness is a lack of input validation (CWE-113).

Affected products include the Hono web framework prior to version 4.12.12, running on Node.js or platforms such as Cloudflare Workers. Any deployment that accepts user-controlled cookie names without filter is susceptible.

With a CVSS score of 6.9 the vulnerability is considered medium severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. The attack vector is likely an application that passes a malicious cookie name; the exploit path involves sending a request that triggers the setCookie() call with an invalid name, causing the runtime to error and abort the response. The impact is a denial of service within the affected component, but does not provide broader access or data compromise.