Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
Priority LOW 28CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed Hono (Hono): 4.12.7hono (npm): 4.12.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| honojs | Hono | before 4.12.7 | 4.12.7 | Patch available | CNA |
| — | hono (npm) | before 4.12.7 | 4.12.7 | Patch available | GHSA-v8w9-8mx6-g223 |
- Hono Vendorhonojs Affected before 4.12.7 Fixed in 4.12.7 Patch available CNA
- hono (npm) Vendor— Affected before 4.12.7 Fixed in 4.12.7 Patch available GHSA-v8w9-8mx6-g223
Remediation
- Fix · CNA Hono (Hono) Fixed in 4.12.7
- Fix · GHSA-v8w9-8mx6-g223 hono (npm) Fixed in 4.12.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56763
- 2026-10-03 Alias added: GHSA-v8w9-8mx6-g223
References
More honojs vulnerabilities
- TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
- TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
- TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
- TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
- TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
- TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-56763 · CVE Program
- CVE-2026-56763 · NVD
- FIRST EPSS
- GHSA-v8w9-8mx6-g223 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences