The hono framework's csrf() middleware does not validate requests with the Content-Type 'text/ping', which are sent by Chromium-based browsers' hyperlink auditing feature. This allows cross-origin POST requests with user cookies to bypass CSRF protections if the state-changing action does not depend on the request body. The vulnerability affects hono versions prior to 4.13.16.