CVE-2026-126356: Hono · `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
Affects honoSource GCVE Database
Not known to be exploited · CVSS 5.3 Medium : upgrade to 4.13.16 when convenient.
Data as of 13 Nov 2026, 00:06 UTC
Thin evidence
One scorer or none| CNA (GitHub_M) | CVSS 3.1 | 5.3 |
|---|
- Patch
- Available – fixed in 4.13.16
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 12 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 12 Nov 2026.
What to do
Upgrade hono to 4.13.16.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmhono | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
### Summary `validator('form')` only recognizes a `multipart/form-data` `Content-Type` that carries nothing but a single `boundary` parameter. A request with another legal parameter, such as `charset`, or with extra whitespace after the `;` is not recognized as a form. The validation callback then receives an empty object, while `c.req.parseBody()` still parses the body as a form. ### Details The check that decides whether a request body is a form was written as a strict pattern over the whole `Content-Type` value. Any parameter list that does not look exactly like `; boundary=...` fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can still read all submitted fields through `c.req.parseBody()` or `c.req.formData()`. `application/x-www-form-urlencoded` is not affected. Only the `multipart/form-data` branch has the strict pattern. This issue arises when an application relies on `validator('form')` to reject or restrict fields and the validation callback does not fail on an empty object. ### Impact An unauthenticated client can send form fields that the `form` validator never sees, by adding a legal parameter to the `Content-Type` header. This may lead to: - Allow-list or required-field checks in the validator being skipped - Fields the application intended to reject reaching the handler This issue affects applications that use `validator('form')` with `multipart/form-data` requests and whose validation callback accepts an empty object. ### Workarounds Reject an empty object in the `validator('form')` callback, or validate the result of `await c.req.parseBody()` in the handler.