CVE-2026-126356: Hono validator form multipart/form-data parameter bypass

CVE-2026-126356 · Severity: medium · CVSS 5.3 · Published 2026-11-13

Hono is a web framework used to build APIs and web applications. The form validator can be bypassed when clients send multipart form data with extra parameters in the Content-Type header, allowing form fields to reach the application handler without validation. An attacker could submit restricted or required fields that the validator is supposed to reject.

Technologies: Hono, hono (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2026-126356 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126356 being exploited in the wild.
How severe is CVE-2026-126356?
Medium severity, with a CVSS score of 5.3, published 13 November 2026.
Which products and versions are affected?
Hono <UNKNOWN>; hono (npm) >= 4.5.1, <= 4.13.15, SEMVER:introduced=4.5.1,fixed=4.13.16.
Is there a fix for CVE-2026-126356?
Yes. hono (npm): upgrade to 4.13.16 or later. Until then: Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126356 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126356?
Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • hono (npm): upgrade to 4.13.16 or later
    npm install hono@4.13.16

Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler.

Technical details

The validator('form') middleware uses a strict regex pattern that only recognizes multipart/form-data Content-Type headers with exactly `; boundary=...`, rejecting headers with additional legal parameters like charset or extra whitespace. When rejected, the middleware passes an empty object to the validation callback; if the callback accepts it, the handler can still parse all form fields via c.req.parseBody() or c.req.formData(). This allows validation bypass for multipart/form-data but not application/x-www-form-urlencoded.

Affected products

  • Hono Hono <UNKNOWN>

Identifiers

  • CVE-2026-126356
  • GHSA-4h7h-rv7c-7m2v

Timeline

  • 2026-11-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.