TI-2026-57975 Aliases CVE-2026-84364 GHSA-g6gw-c38x-mqfc

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

LOW 31CWE-400Published 2026-09-01 · Updated 2026-09-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00529 45th percentileScored 2026-11-07

Fix Fixed hono (honojs): 4.13.5hono (npm): 4.13.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
honojs	hono	before 4.13.5	4.13.5	Patch available	CNA
—	hono (npm)	before 4.13.5	4.13.5	Patch available	GHSA-g6gw-c38x-mqfc

hono Vendorhonojs Affected before 4.13.5 Fixed in 4.13.5 Patch available CNA
hono (npm) Vendor— Affected before 4.13.5 Fixed in 4.13.5 Patch available GHSA-g6gw-c38x-mqfc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hono:hono::::::::	—	—	honojs

cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

Fix · CNA hono (honojs) Fixed in 4.13.5
Fix · GHSA-g6gw-c38x-mqfc hono (npm) Fixed in 4.13.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-84364
2026-10-03 Alias added: GHSA-g6gw-c38x-mqfc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-84364

Other 4

TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8

See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences