Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
Summary
When using parseBody({ dot: true }) in HonoRequest, specially crafted form field names such as __proto__.x could create objects containing a __proto__ property.
If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.
Details
The parseBody({ dot: true }) feature supports dot notation to construct nested objects from form field names.
In previous versions, the __proto__ path segment was not filtered. As a result, specially crafted keys such as __proto__.x could produce objects containing __proto__ properties.
While this behavior does not directly modify Object.prototype within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns.
Impact
Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | hono | < 4.12.7 | 4.12.7 |
References
- https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223
- https://nvd.nist.gov/vuln/detail/CVE-2026-56763
- https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe
- https://github.com/honojs/hono
- https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-1321- Platform
- npm
- Package
hono- Disclosed
- 11.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v8w9-8mx6-g223 - CC BY 4.0
Vulnerability history: hono
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 52
- First → latest
- 12.2023 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 4
Disclosures per year
- 2023: 1
- 2024: 3
- 2025: 4
- 2026: 44
-
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.