Cross-site request forgery in hono - CVE-2026-126355
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164375
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126355
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to trigger unauthorized state changes in applications where endpoint actions do not depend on the request body.
The vulnerability exists due to incomplete cross-site request forgery validation in Hono's csrf() middleware when handling text/ping requests, which bypass Origin and Sec-Fetch-Site checks. A remote attacker can trick a logged-in Chrome or Edge user into clicking an <a ping> hyperlink on a malicious page to trigger a state-changing cross-origin POST when the browser sends the user's cookies.
Affected software
hono
How to mitigate CVE-2026-126355
Install security update from vendor's website.
hono - update to 4.13.16