Improper Encoding or Escaping of Output in hono - CVE-2026-54287
Published: July 21, 2026
Vulnerability identifier: #VU138921
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54287
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify data on the system.
The vulnerability exists due to on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. A remote attacker can trigger improper encoding or escaping of output to modify data on the system.
Affected software
hono
Informix Dynamic Server
IBM App Connect Enterprise
Informix Dynamic Server
IBM App Connect Enterprise
How to mitigate CVE-2026-54287
Install updates from vendor's website.
hono - update to 4.12.25
Informix Dynamic Server - addressed in versions 14.10.FC14, 15.0.1.14
IBM App Connect Enterprise - update to 13.0.8.0
Informix Dynamic Server - addressed in versions 14.10.FC14, 15.0.1.14
IBM App Connect Enterprise - update to 13.0.8.0