Input validation error in hono - CVE-2026-126356
Published: November 10, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU164376
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126356
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass form validation and submit fields the application intended to reject.
The vulnerability exists due to improper input validation in Hono's validator('form') middleware when strict Content-Type matching rejects multipart/form-data headers with additional parameters or whitespace, passing an empty object to validation instead. A remote attacker can send such requests to bypass field checks and deliver unvalidated fields to handlers if the validation callback accepts an empty object.
Affected software
hono
How to mitigate CVE-2026-126356
Install security update from vendor's website.
hono - update to 4.13.16