HONO · GHSA-46wx-v44x-9hh2 · Package
FIX → 4.13.16
The csrf() middleware in Hono only checks requests whose Content-Type is a form type, so Chromium hyperlink-auditing POSTs with text/ping skip the origin check. A malicious page visited by a logged-in user in Chrome or Edge can make the browser send a state-changing request to the application.
first public Nov 1, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built with Hono that use the csrf() middleware as their CSRF protection and expose state-changing endpoints whose effect does not depend on the request body. Applications without csrf(), or whose state-changing routes need a body or a non-cookie credential, are less exposed. Browsers other than Chrome and Edge do not send these pings by default.
Not affected if firefox-only-users, no-csrf-middleware, no-state-changing-get-or-query-routes
Who cares bun, cloudflare-workers, deno, hono, node
npm ls hono and compare it to 4.13.16.csrf() from hono/csrf and confirm whether it relies on it for CSRF protection.Upgrade to 4.13.16
csrf() validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing (<a ping>) sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or Sec-Fetch-Site for such a request, so it is passed to the handler.
The middleware skips the origin check when the content type is not one that a form submission produces. The assumption was that any other content type requires a CORS preflight and therefore cannot be sent cross-origin with credentials. Hyperlink auditing is an exception: Chrome and Edge send the ping as a credentialed POST without a preflight, with a fixed body and Content-Type: text/ping.
A page on another origin can therefore trigger a POST to any URL of the application. The csrf() options for origin and secFetchSite do not change the outcome, because neither header is evaluated for the request.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hono 4.13.16 and later (fixed version from the product data).The request body is fixed, so only actions whose effect does not depend on the body can be triggered. Firefox does not send pings by default. As with any CSRF, the user's cookie must be sent with the request, which with the default SameSite=Lax means a same-site origin or a cookie set with SameSite=None.
A user who visits a malicious page in Chrome or Edge while logged in to an application protected by csrf() can be made to send a state-changing request to that application, such as logging out, deleting a resource, or toggling a setting that is selected by the path or query string.
This issue affects applications that rely on csrf() as their CSRF protection and expose state-changing endpoints whose effect does not depend on the request body.
Reject requests with a Content-Type of text/ping in a middleware registered before csrf(), or set session cookies with SameSite=Strict.