CVE-2026-126356

CVSS 5.3 (medium) · published 2026-11-13

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.

Weakness: CWE-20

Source: NVD CVE-2026-126356

References

• https://github.com/honojs/hono/commit/d88fab372415277a9e540e895650943dd08eef4a
• https://github.com/honojs/hono/releases/tag/v4.13.16
• https://github.com/honojs/hono/security/advisories/GHSA-4h7h-rv7c-7m2v

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.