Vulnerability in Hono Web Application Framework Affects JavaScript Runtime

CVE-2026-126356

What is CVE-2026-126356?

The Hono Web application framework has a vulnerability in its form validator that affects versions from 4.5.1 to 4.13.16. The validator uses a strict header pattern that does not correctly identify multipart/form-data when the Content-Type includes extra legal parameters or whitespace. As a result, an unauthenticated client can bypass critical validation checks, leading to potential exposure of sensitive data through successful form submissions. The issue has been remedied in version 4.13.16, highlighting the importance of keeping software up to date to mitigate such issues.

References