Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
Summary
When using parseBody({ dot: true }) in HonoRequest, specially crafted form field names such as __proto__.x could create objects containing a __proto__ property.
If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.
Details
The parseBody({ dot: true }) feature supports dot notation to construct nested objects from form field names.
In previous versions, the __proto__ path segment was not filtered. As a result, specially crafted keys such as __proto__.x could produce objects containing __proto__ properties.
While this behavior does not directly modify Object.prototype within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns.
Impact
Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | hono | < 4.12.7 | 4.12.7 |
Referencias
- https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223
- https://nvd.nist.gov/vuln/detail/CVE-2026-56763
- https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe
- https://github.com/honojs/hono
- https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N- Debilidad (CWE)
CWE-1321- Plataforma
- npm
- Paquete
hono- Publicada
- 11.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-v8w9-8mx6-g223 - CC BY 4.0
Historial de vulnerabilidades: hono
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 52
- Primera → última
- 12.2023 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 7
- Media 41
- Baja 4
Divulgaciones por año
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.