Regression Case Files
Regression Case FileIndependent OSS replay

A valid form request could return corrupted data.

Hono v4.12.28 could corrupt form fields when middleware called formData() before a handler called parseBody(). Three releases were affected before v4.12.31 restored the reported behavior.

The request could return HTTP 200.The form fields were corrupted.
Baselinev4.12.27
analyzed change
Releasedv4.12.28
3 releases affected
Restoredv4.12.31
The case file

The anatomy of a regression

  1. 01 Project
  2. 02 Regression & fix
  3. 03 Early replay
The project

A web framework built on Web Standards.

Hono is an open-source TypeScript web framework that runs across Node.js, Bun, Deno, Cloudflare Workers, and other Web Standards runtimes.

Project repository
The regression & fix

Form parsing could fail or corrupt fields.

parseFormData began reading an arrayBuffer. When formData was already cached, Hono reserialized it with a new multipart boundary, then parsed those bytes using the original request header and its old boundary. The reported path was fixed by reusing the cached formData value.

Middleware formData() → request body cache → handler parseBody() → parsed fields
A cached Hono form uses the original multipart boundary, but the derived bytes use a new boundary before parseBody reads them with the old header.
The cached form bytes and original request header no longer described the same multipart boundary.
Compared
v4.12.27 → v4.12.28
Affected
v4.12.28–v4.12.30 · 3 releases
Public report
User · 11 days after release
Fixed
v4.12.31 · 12 days later
Early product finding titled parseBody after formData corrupts multipart boundary, with Before and Now explanations of the cache mismatch.
Actual Early product finding from the August 24 corroborating replay.
The Early replay

Early found the regression.

1Regression
6Expected changes
Early verdict · Regression

“parseBody after formData() corrupts multipart boundary”

Early traced the corruption to a boundary mismatch: cached FormData was reserialized with a new multipart boundary, then parsed using the original request header. The reproduction passed before v4.12.28, failed across v4.12.28 through v4.12.30, and passed again on v4.12.31.

Primary evidence

Follow the record.

Independent replay. Not affiliated with Hono.

Explore more Case Files
Your case file

Remember your last regression?

Let Early trace it