The vulnerability in honojs hono (before 4.12.21) involves improper neutralization of CRLF sequences in HTTP headers, specifically in the serialize() function used for cookie handling. While domain and path options are validated to prevent injection of characters like ';', '\r', and '\n', the sameSite and priority options lack this validation. This can lead to HTTP response splitting by allowing attacker-controlled input to inject additional Set-Cookie attributes. The issue is addressed in version 4.12.21.

An attacker who can control input passed to the sameSite or priority options in the serialize() function may cause the application to generate a Set-Cookie header with injected attributes. This can lead to HTTP response splitting attacks, potentially allowing header injection or manipulation of cookie attributes. The CVSS score of 4.3 reflects a medium impact with limited integrity impact and no confidentiality or availability impact.

Upgrade the honojs hono framework to version 4.12.21 or later, where this vulnerability is fixed. There is no vendor advisory explicitly provided, but the description confirms the fix in 4.12.21. Until upgrading, avoid passing user-controlled input to the sameSite and priority options in cookie serialization.