HONO · GHSA-4h7h-rv7c-7m2v · Package
FIX → 4.13.16
Hono's validator('form') middleware only recognizes a multipart/form-data Content-Type with a single boundary parameter, so a request adding a charset parameter or extra whitespace is treated as having no form data. The validation callback then receives an empty object while the handler can still read all submitted fields.
first public Nov 1, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Hono's validator('form') on routes that accept multipart/form-data and whose validation callback accepts an empty object. An attacker can add a legal Content-Type parameter such as charset to bypass field checks, and the handler still reads the form fields. Routes that do not use validator('form'), use only urlencoded bodies, or reject empty objects are not exposed.
Not affected if no-validator-form, rejects-empty-object, urlencoded-only
Who cares bun, cloudflare-workers, deno, hono, node
npm ls hono in the project and look for a version between 4.5.1 and 4.13.15validator('form' to find routes that rely on the form validatorUpgrade to 4.13.16
validator('form') only recognizes a multipart/form-data Content-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empty object, while c.req.parseBody() still parses the body as a form.
The check that decides whether a request body is a form was written as a strict pattern over the whole Content-Type value. Any parameter list that does not look exactly like ; boundary=... fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can still read all submitted fields through c.req.parseBody() or c.req.formData().
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
4.13.16await c.req.parseBody() in the handlerapplication/x-www-form-urlencoded is not affected. Only the multipart/form-data branch has the strict pattern.
This issue arises when an application relies on validator('form') to reject or restrict fields and the validation callback does not fail on an empty object.
An unauthenticated client can send form fields that the form validator never sees, by adding a legal parameter to the Content-Type header.
This may lead to:
This issue affects applications that use validator('form') with multipart/form-data requests and whose validation callback accepts an empty object.
Reject an empty object in the validator('form') callback, or validate the result of await c.req.parseBody() in the handler.