CVE-2026-126356
Deferred Deferred - Pending Action

Hono Framework Form Validator Bypass via Multipart Content-Type

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126356

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
honojs hono to 4.13.16 (exc)
honojs hono 4.13.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Hono versions 4.5.1 to 4.13.15 involves the validator('form') middleware failing to validate multipart/form-data requests when the Content-Type header contains extra parameters or whitespace after a semicolon. This causes the validator to pass an empty object to the callback while still allowing the handler to parse full form data, enabling bypass of allow-list or required-field checks.

Detection Guidance

To detect this vulnerability, inspect HTTP requests to your Hono application handling form data. Check if the Content-Type header for multipart/form-data requests includes extra parameters (e.g., charset) or whitespace after a semicolon. Use tools like Wireshark or tcpdump to capture and analyze traffic. Alternatively, log the Content-Type header and parsed body data in your application to identify requests where the validator receives an empty object but the handler still parses full form data.

Impact Analysis

Unauthenticated attackers can manipulate the Content-Type header to bypass form validation, potentially submitting restricted or unvalidated fields to the application. This could lead to unauthorized data processing, data corruption, or other integrity issues if the application relies on validator('form') for security checks.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data processing or exposure if form validation is bypassed. Applications relying on validator('form') for data integrity checks may fail to meet GDPR or HIPAA requirements for proper data validation and access controls.

Mitigation Strategies
  • Upgrade Hono to version 4.13.16 or later to apply the security fix.
  • If upgrading is not immediately possible, implement a workaround by explicitly rejecting empty objects in the validator callback or validate parsed body data in the handler.
  • Review applications using validator('form') to ensure they handle multipart/form-data requests securely, especially if relying on allow-list or required-field checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...