CVE-2026-126355

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.16

Description The csrf() middleware fails to validate requests with the text/ping content type, which is used by Chromium hyperlink auditing via the <a ping> action. Because the middleware only validates content types typically sent by HTML forms, it skips Origin and Sec-Fetch-Site checks for these requests. This allows Chrome and Edge to send cross-origin credentialed POST requests without a CORS preflight. An attacker can trigger state-changing requests to endpoints where the action is determined by the path or query string and does not rely on the request body. This requires the user's cookie to be sent, which occurs if the origin is same-site or the cookie is configured with SameSite=None.

Recommendations Update to version 4.13.16. As a temporary workaround, reject requests with a Content-Type of text/ping using a middleware registered before csrf(). Set session cookies with SameSite=Strict to minimize the risk of exploitation.