npm: Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

npm: Hono: csrf does not check requests sent by hyperlink auditing text/ping vulnerability discovered by ? in WordPress npm hono versions 4.13.16...

Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

CVE-2026-126355

The Hono web application framework is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 4.13.16 because the csrf() middleware fails to validate text/ping requests generated by Chromium hyperlink auditing. Attackers can use actions in Chrome and Edge to send cross-origin creden...

EUVD-2026-124735

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-126355: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...