CVE-2026-126356

Name of the Vulnerable Software and Affected Versions Hono versions 4.5.1 through 4.13.15

Description The validator('form') function fails to correctly recognize multipart/form-data when the Content-Type header contains extra whitespace after a semicolon or includes additional legal parameters, such as charset. This occurs because the software uses a strict whole-header pattern for validation. When the pattern fails, the validation callback receives an empty object, but the request body can still be parsed and accessed by the handler via c.req.parseBody() or c.req.formData(). Consequently, an unauthenticated client can bypass required-field checks or allow-lists if the validation callback accepts an empty object. This issue does not affect application/x-www-form-urlencoded requests.

Recommendations Update to version 4.13.16. As a temporary workaround, reject empty objects within the validator('form') callback or validate the result of await c.req.parseBody() directly in the handler.