CVE catalog
CVE-2026-56763
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged
- Severity
- Medium · CVSS 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.27% · Oct 25, 2026
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Npm | hono | Not reported | 4.12.7 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Npm | hono | npm | Not reported | 4.12.7 | Not reported | GHSA-V8W9-8MX6-G223 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/advisories/GHSA-v8w9-8mx6-g223]
- [https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-56763]
- [https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option]
[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]