https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 05:03:29 +0000 https://db.gcve.eu/vuln/cve-2026-126356 <p><strong>Affected:</strong> honojs hono</p> <p>Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator(&#39;form&#39;) uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.</p> <p><strong>Affected:</strong> honojs hono</p> <p>Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator(&#39;form&#39;) uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.</p> https://db.gcve.eu/vuln/cve-2026-126356