fix: prevent crash when Node rejects Set-Cookie header

lib/transmit.js

@@ -29,6 +29,13 @@ exports.send = async function (request) {
     }
     catch (err) {
         Bounce.rethrow(err, 'system');
+
+        // Drop pending states so the error response does not re-apply Set-Cookie
+        // values that Node already rejected (e.g. non-ASCII cookie values that
+        // pass statehood validation but fail res.setHeader). Re-emitting them
+        // would crash again inside fail() without a recovery path (#4527).
+
+        request._states = {};
         request._setResponse(err);
         return internals.fail(request, err);
     }

test/state.js

@@ -236,4 +236,27 @@ describe('state', () => {
         expect(res.statusCode).to.equal(500);
         expect(res.request.response._error).to.be.an.error('Partitioned cookies must have SameSite=None');
     });
+
+    it('returns 500 without crashing when a cookie value is rejected by Node', async () => {
+
+        // Non-ASCII cookie values pass statehood's strictHeader regex but Node's
+        // setHeader rejects them (ERR_INVALID_CHAR). The error path must not
+        // re-apply the same Set-Cookie or the process crashes (#4527).
+
+        const server = Hapi.server({ debug: false });
+        server.route({
+            method: 'GET',
+            path: '/',
+            handler: (request, h) => h.response('ok').state('cookieName2', 'тест')
+        });
+
+        const res = await server.inject('/');
+        expect(res.statusCode).to.equal(500);
+        expect(res.headers['set-cookie']).to.not.exist();
+        expect(res.result).to.equal({
+            statusCode: 500,
+            error: 'Internal Server Error',
+            message: 'An internal server error occurred'
+        });
+    });
 });