CVE-2026-126356 Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

The Hono web framework (versions 4.5.1 through 4.13.15 ) contains a vulnerability where the validator('form') function fails to recognize multipart/form-data requests if the Content-Type header includes extra whitespace or additional legal parameters. This occurs because of a strict whole-header ...