p PatchFirst

CVE-2026-56763

CVE-2026-56763 · Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • hono

    Versions
    • ≥ 0, < 4.12.7: Affected (semver)
    • 4.12.7: Not affected (semver)

    Update to 4.12.7

  • hono npm

    Affected ranges
    • SEMVER: < 4.12.7

    Update to 4.12.7

Original sources

Check your server →