Cross-Site Request Forgery Flaw in Hono Web Application Framework

CVE-2026-126355

What is CVE-2026-126355?

The Hono Web Application Framework, prior to version 4.13.16, features a cross-site request forgery vulnerability that limits origin validation. This flaw enables attackers to exploit certain types of requests generated by Chromium’s hyperlink auditing, particularly through the <a ping> action. Without proper validation for such requests, an attacker could potentially execute a cross-origin credentialed POST request, bypassing critical security checks. The effective mitigation introduced in version 4.13.16 constrains the impact of this vulnerability by ensuring that exploitation is limited to state-changing operations defined by the request path or query string, while also enforcing that the user's cookie accompanies the request.

References