---
id: "GHSA-92p4-j3wq-jmqx"
page: "https://infrastack.ai/live/GHSA-92p4-j3wq-jmqx"
kind: "vulnerability"
aliases: ["GHSA-92p4-j3wq-jmqx"]
title: "`validator()` skips validation for requests whose `Content-Type` parameters are formatted differently (incomplete fix for GHSA-4h7h-rv7c-7m2v)"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hono", "fixed": ["4.13.18"], "affected": ">= 4.5.1, <= 4.13.17", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["api", "cwe-20", "hono", "node", "npm", "package"]
not_affected_if: ["callback-rejects-empty-object", "hono-outside-affected-range", "no-json-or-form-validator"]
published_at: "2026-11-11T08:54:55+00:00"
first_seen_at: "2026-11-11T08:59:08+00:00"
updated_at: "2026-11-11T09:01:19+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/honojs/hono/security/advisories/GHSA-92p4-j3wq-jmqx", "first_seen_at": "2026-11-11T08:59:08+00:00"}]
exploit_sources: []
---

# `validator()` skips validation for requests whose `Content-Type` parameters are formatted differently (incomplete fix for GHSA-4h7h-rv7c-7m2v)

Link for people: https://infrastack.ai/live/GHSA-92p4-j3wq-jmqx (this .md is for agents)

Hono's validator('json') and validator('form') middleware fail to read the request body when the Content-Type header is legal but formatted differently, such as extra whitespace or a trailing semicolon. The validation callback then receives an empty object while the handler still reads the full body, so an attacker can send fields the validator was meant to reject.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:hono affected >= 4.5.1, <= 4.13.17 fixed 4.13.18

## How to check

- Check the installed Hono version: `npm ls hono`
- Search the code for `validator('json')` or `validator('form')` and confirm whether the callback rejects or restricts fields or accepts an empty object
- Look for allow-list or required-field checks that depend only on the validator

## Fix

- hono: move to `4.13.18`

## Timeline

- 2026-11-11T08:59:08+00:00 ghsa-repo https://github.com/honojs/hono/security/advisories/GHSA-92p4-j3wq-jmqx

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/honojs/hono/security/advisories/GHSA-92p4-j3wq-jmqx

## From the sources

### Summary

`validator('json')` and `validator('form')` decide whether to read the request body by matching the whole `Content-Type` value against a strict pattern. A value that is legal but formatted differently, such as whitespace before `;`, a trailing `;`, or a parameter name with an underscore, does not match. The validation callback then receives an empty object, while `c.req.json()` and `c.req.parseBody()` in the handler still read the body.

GHSA-4h7h-rv7c-7m2v fixed this for a `multipart/form-data` value with extra parameters. The same problem remained for other parameter formats and for `application/json`.

### Details

The media type and its parameters were checked together with one pattern per target. Anything outside the pattern, including `application/json ; charset=utf-8`, `multipart/form-data; boundary=x;` and `application/x-www-form-urlencoded; x_y=1`, failed the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which can read all submitted fields.

The validator now takes the media type as the part before the first `;`, trimmed and lowercased, and decides on that alone. This is the same rule `c.req.parseBody()` uses, so the two can no longer disagree about the same request. Structured JSON suffixes such as `application/vnd.api+json` and subtypes containing digits are accepted as JSON.

This issue arises when an application relies on `validator('json')` or `validator('form')` to reject or restrict fields and the validation callback does not fail on an empty object.

### Impact

An unauthenticated client can send JSON or form fields that the validator never sees, by formatting the `Content-Type` header differently.

This may lead to:

- Allow-list or required-field checks in the validator being skipped
- Fields the application intended to reject reaching the handler

This issue affects applications that use `validator('json')` or `validator('form')` and whose validation callback accepts an empty object.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_