CVE-2026-54287

What it actually does

This is a response-header serialization flaw in Hono before 4.12.25 when deployed on AWS Lambda behind Application Load Balancer single-header responses or VPC Lattice v2 responses. Multiple Set-Cookie headers can be incorrectly joined into one comma-separated Set-Cookie value. Because valid cookie attributes such as Expires contain commas, browsers and HTTP clients cannot reliably split the combined value back into separate cookies. The result is silent cookie loss or cookie misparsing, which can weaken application state handling, authentication/session flows, CSRF protections, preference persistence, logout behavior, or token rotation logic. It is not a remote code execution or data disclosure issue by itself; the direct impact is integrity degradation of HTTP cookie handling.

Why it matters to the business

Applications using affected Hono versions in the impacted AWS Lambda integrations may behave inconsistently for users, especially around login, logout, session renewal, OAuth callbacks, CSRF token setup, and other workflows that set more than one cookie in a single response. This can lead to failed sign-ins, broken customer journeys, increased support volume, and potential weakening of security controls that depend on cookies being stored exactly as intended. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no public exploit maturity is reported, so urgency should be driven mainly by whether production services use Hono on AWS Lambda with ALB single-header or VPC Lattice v2 response modes and set multiple cookies.

How an attack unfolds

An attacker does not need credentials to trigger the vulnerable behavior if a public endpoint returns multiple Set-Cookie headers through an affected Hono deployment path. The attacker identifies or guesses workflows that set multiple cookies, such as authentication redirects, token refresh endpoints, logout handlers, consent/preference updates, or CSRF initialization routes. When the vulnerable Lambda integration serializes the response, the distinct Set-Cookie headers are collapsed into a single comma-separated value. The browser then misinterprets or drops one or more cookies, particularly where an Expires attribute contains a comma. Depending on how the application uses those cookies, this may produce inconsistent security state, missing CSRF/session cookies, failed logout or login, stale session identifiers, or other logic errors. Exploitation is application-dependent and generally manifests as manipulation or disruption of cookie-backed state rather than host compromise.

How to fix it

Upgrade Hono to version 4.12.25 or later wherever it is used. Prioritize services deployed on AWS Lambda through Application Load Balancer single-header responses or VPC Lattice v2 response format, especially services that set multiple cookies in one response. If immediate upgrade is not possible, mitigate by avoiding affected response modes where feasible, ensuring responses preserve multiple Set-Cookie headers as separate header fields, or modifying affected flows so they do not emit multiple cookies in the same vulnerable response path. Review authentication, logout, OAuth, CSRF, and token rotation handlers for multi-cookie responses. After upgrading, rebuild and redeploy all affected serverless artifacts and verify that dependency lockfiles and bundled runtime packages actually contain Hono 4.12.25 or newer.

How to confirm the fix worked

Confirm the deployed application uses Hono 4.12.25 or later by checking package manifests, lockfiles, SBOMs, build artifacts, and deployed Lambda bundles. For runtime validation, issue test requests to endpoints that intentionally set multiple cookies and inspect the raw HTTP response. A fixed deployment should return separate Set-Cookie header fields, not a single comma-joined Set-Cookie value. Include test cases where one cookie uses an Expires attribute, because Expires dates contain commas and expose the parsing failure. Validate through the same production-like AWS path used by real clients, such as ALB or VPC Lattice, rather than only testing the application locally. Browser developer tools, curl with verbose output, HAR captures, or synthetic monitoring can confirm whether all expected cookies are stored correctly.

Typical attack path

1. Identify a Hono application deployed on AWS Lambda behind an affected response mode, specifically ALB single-header responses or VPC Lattice v2 responses.
2. Find endpoints that issue more than one Set-Cookie header in the same response, such as login, OAuth callback, logout, token refresh, CSRF bootstrap, or preference-setting endpoints.
3. Send unauthenticated requests to those endpoints and inspect whether the response contains a single comma-joined Set-Cookie header instead of separate Set-Cookie headers.
4. Use the malformed cookie response to cause the client to drop or misparse cookies.
5. Abuse the resulting inconsistent application state where possible, such as broken CSRF setup, failed session rotation, unreliable logout, or other cookie-dependent logic flaws.

How to detect it

This issue does not produce a reliable malware-style indicator and exploitation may look like normal web traffic. To assess whether it was triggered or abused, review response-header captures from application logs, reverse proxies, WAF tooling with response inspection, synthetic monitoring, HAR files, or packet captures for endpoints that set multiple cookies. Look for a single Set-Cookie header containing multiple cookie assignments separated by commas, especially when an Expires attribute is present. Correlate those responses with user-impact signals such as repeated login attempts, OAuth callback loops, missing CSRF cookies, CSRF validation failures, unexpected logout failures, token refresh errors, or sudden increases in session initialization. Standard ALB access logs generally do not include response headers, so detection may require enhanced application logging, temporary response-header instrumentation, browser-side HAR collection, or controlled replay testing through the affected AWS integration path. There are no known named threat actors, KEV listing, ransomware association, or public exploit maturity reported for this vulnerability.

What your security team should do

• Inventory Hono usage across JavaScript/TypeScript services and identify versions earlier than 4.12.25.
• Prioritize remediation for AWS Lambda deployments using ALB single-header responses or VPC Lattice v2 response format.
• Upgrade Hono to 4.12.25 or later and redeploy affected Lambda packages.
• Test authentication, logout, OAuth callback, CSRF setup, token refresh, and preference flows for correct multi-cookie behavior after remediation.
• Add regression tests or synthetic checks that verify multiple Set-Cookie headers are preserved as separate headers through the full edge-to-Lambda path.
• Review recent application telemetry for spikes in login failures, CSRF validation failures, repeated session initialization, logout anomalies, or user reports consistent with dropped cookies.
• Because EPSS is low and this is not in KEV, treat as a targeted application-integrity issue rather than an emergency mass-exploitation event unless exposed critical workflows depend on multi-cookie responses.