CVE-2026-126355: Hono csrf() middleware bypass via hyperlink auditing

CVE-2026-126355 · Severity: medium · CVSS 5.3 · Published 2026-11-13

Hono is a web framework with built-in CSRF protection. The csrf() middleware fails to validate requests sent by Chromium's hyperlink auditing feature (text/ping content type), allowing an attacker on a malicious website to trigger state-changing actions in a victim's application without their knowledge—such as logging them out, deleting resources, or changing settings.

Technologies: Hono, hono (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-126355 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126355 being exploited in the wild.
How severe is CVE-2026-126355?
Medium severity, with a CVSS score of 5.3, published 13 November 2026.
Which products and versions are affected?
Hono <UNKNOWN>; hono (npm) < 4.13.16, SEMVER:introduced=0,fixed=4.13.16.
Is there a fix for CVE-2026-126355?
Yes. hono (npm): upgrade to 4.13.16 or later. Until then: Reject requests with Content-Type: text/ping in a middleware registered before csrf(), or set session cookies with SameSite=Strict.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126355 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126355?
Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • hono (npm): upgrade to 4.13.16 or later
    npm install hono@4.13.16

Reject requests with Content-Type: text/ping in a middleware registered before csrf(), or set session cookies with SameSite=Strict.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}]

Technical details

The csrf() middleware only validates Origin and Sec-Fetch-Site headers for requests with content types that HTML forms can produce (application/x-www-form-urlencoded, multipart/form-data, text/plain); it skips validation for other content types assuming they require CORS preflight. Chromium's hyperlink auditing bypasses this assumption by sending credentialed POST requests with Content-Type: text/ping without preflight, allowing cross-origin CSRF. The vulnerability affects only actions whose effect is independent of the request body, and requires the user's cookies to be sent (default SameSite=Lax permits this from same-site or SameSite=None cookies).

Affected products

  • Hono Hono <UNKNOWN>

Identifiers

  • CVE-2026-126355
  • GHSA-46wx-v44x-9hh2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.