CVE-2026-126356: Multipart Form Validation Bypass in Hono Web Framework

Vulnerability ID: CVE-2026-126356
CVSS Score: 5.3
Published: 2026-11-12

A parser differential vulnerability exists in the Hono web application framework versions 4.5.1 prior to 4.13.16. The built-in form validation middleware (validator('form')) utilizes an overly restrictive regular expression to evaluate the HTTP Content-Type header for multipart/form-data payloads. When a client supplies additional valid MIME parameters (such as charset=utf-8) or multiple whitespace characters following a semicolon delimiter, the regular expression fails to match. Consequently, the validator passes an empty object to the validation callback instead of the parsed form fields. If the validation logic permits empty objects or only checks for disallowed values on optional properties, the request passes validation, allowing downstream route handlers calling c.req.parseBody() or c.req.formData() to process unvalidated user input.

TL;DR

Hono versions 4.5.1 to 4.13.15 fail to validate multipart/form-data requests when the Content-Type header includes extra parameters or multiple spaces after a semicolon. This parser differential passes an empty object to the validator while exposing the full unvalidated payload to downstream handlers via c.req.parseBody() or c.req.formData().

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-126356 (GHSA-4h7h-rv7c-7m2v)
• Primary CWE: CWE-20 (Improper Input Validation) / CWE-1471 (Parser Differential)
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
• Attack Vector: Network (Unauthenticated HTTP multipart/form-data request)
• Affected Versions: hono >= 4.5.1, < 4.13.16
• Patched Version: hono 4.13.16
• Exploit Status: Proof-of-Concept (Regression tests available)
• CISA KEV Status: Not Listed

Affected Systems

• Hono Web Framework (npm package hono)
• @hono/node-server
• @hono/bun
• @hono/deno
• @hono/cloudflare-workers
• @hono/vercel
• @hono/aws-lambda
• @hono/netlify
• hono: >= 4.5.1, < 4.13.16 (Fixed in: 4.13.16)

Code Analysis

Commit: d88fab3

Update multipartRegex in src/validator/validator.ts to allow arbitrary whitespace and extra MIME parameters in multipart/form-data Content-Type headers.

--- a/src/validator/validator.ts
+++ b/src/validator/validator.ts
@@ -22,7 +22,7 @@ export type ValidationFunction<
 ) => OutputType | TypedResponse | Promise<OutputType> | Promise<TypedResponse>

 const jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i
-const multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/i
+const multipartRegex = /^multipart\/form-data(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i
 const urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i

 export type ExtractValidationResponse<VF> = VF extends (value: any, c: any) => infer R

Mitigation Strategies

• Upgrade the hono package to version 4.13.16 or later to ensure multipartRegex properly matches multipart/form-data headers with extra parameters or whitespace.
• Refactor route handlers to read form data strictly through c.req.valid('form') instead of calling c.req.parseBody() or c.req.formData() directly.
• Enforce strict non-empty object validation in validator('form') callbacks and schema definitions so that unparsed requests returning {} are rejected immediately.
• Deploy WAF or reverse proxy rules to normalize Content-Type headers or block multipart/form-data requests containing unexpected MIME parameters.

Remediation Steps:

1. Identify all projects using hono within the vulnerable version range (>= 4.5.1, < 4.13.16).
2. Run npm install hono@^4.13.16 (or the equivalent command for pnpm, yarn, or bun) to install the patched release.
3. Audit route handlers that use validator('form') to verify they consume c.req.valid('form') rather than calling c.req.parseBody() or c.req.formData().
4. Verify that validation schemas reject empty objects {} when form parameters are required.

References

• GitHub Security Advisory GHSA-4h7h-rv7c-7m2v
• Hono Patch Commit d88fab372415277a9e540e895650943dd08eef4a
• Hono Release v4.13.16
• NVD Detail for CVE-2026-126356
• CVE.org Record for CVE-2026-126356
• CVE List V5 Repository Record for CVE-2026-126356

Read the full report for CVE-2026-126356 on our website for more details including interactive diagrams and full exploit analysis.