CVE-2026-126356: Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
Summary
validator('form') only recognizes a multipart/form-data Content-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empty object, while c.req.parseBody() still parses the body as a form.
Details
The check that decides whether a request body is a form was written as a strict pattern over the whole Content-Type value. Any parameter list that does not look exactly like ; boundary=... fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can still read all submitted fields through c.req.parseBody() or c.req.formData().
application/x-www-form-urlencoded is not affected. Only the multipart/form-data branch has the strict pattern.
This issue arises when an application relies on validator('form') to reject or restrict fields and the validation callback does not fail on an empty object.
Impact
An unauthenticated client can send form fields that the form validator never sees, by adding a legal parameter to the Content-Type header.
This may lead to:
- Allow-list or required-field checks in the validator being skipped - Fields the application intended to reject reaching the handler
This issue affects applications that use validator('form') with multipart/form-data requests and whose validation callback accepts an empty object.
Workarounds
Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler.
Other sources
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/honoto a version that resolves this vulnerability.Fixed in 4.13.16 - Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.13.16 - Compensating control
Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler.
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using Hono's validator('form') for multipart/form-data requests are exposed if they rely on the validator to reject or restrict submitted fields and their validation callback accepts an empty object. application/x-www-form-urlencoded requests are not affected.
What does an attacker need to send to bypass the form validation path?
An unauthenticated client can send a multipart/form-data request whose Content-Type includes an additional legal parameter, such as charset, or extra whitespace after the semicolon. This causes the validator callback to receive an empty object even though the request body remains available to the handler as parsed form data.
Are all multipart/form-data requests affected?
No. The issue occurs when the Content-Type parameter list does not match the expected single boundary parameter format exactly. A multipart Content-Type with only the expected boundary parameter is recognized by the affected validation branch.
What can be done if updating is not immediately possible?
Ensure validation callbacks fail when they receive an empty object where form fields are required, rather than accepting it. Also avoid relying solely on validator('form') to restrict multipart fields when handlers subsequently read fields with c.req.parseBody() or c.req.formData().
How can I determine whether a route is vulnerable?
Review routes that use validator('form') and then read multipart fields in the handler. They are vulnerable when the validation callback accepts an empty object and the handler can act on fields parsed from the same request body.