Packages / hono / Security

ModerateVulnerabilityGHSA-j6c9-x7qj-28xfPublished 16 Jun 2026

hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

Affected releases · hono

  • 4.x4.0.0 – 4.12.24Fixed in 4.12.25
  • 3.x and older0.0.1 – 3.12.12No fix, no longer updated

On 4.x, the newest line:

npm install hono@4.12.25
4.x

  1. Affected

    4.0.0 – 4.12.24

    171 releases

  2. Fixed

    4.12.25 – 4.13.13

    24 releases, latest

3.x

  1. Affected

    3.0.0 – 3.12.12

    92 releases

2.x

  1. Affected

    2.0.0 – 2.7.8

    49 releases

1.x

  1. Affected

    1.0.0 – 1.6.4

    29 releases

0.x

  1. Affected

    0.0.1 – 0.5.10

    45 releases

410 stable releases of hono, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for hono. It is read in your browser and sent nowhere.

What happens

The full text is not stored yet. Read it on osv.dev.