CVE-2026-56763Medium· 4.8▾ SunlitHono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
hono < 4.12.7Patched in:
hono 4.12.7Connected by shared product, vendor, weakness, or advisory.
GHSA-3wcj-gjvf-fvchMedium· 4.8Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
GHSA-cw3j-28qq-x3xhMedium· 6.5Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
CVE-2025-71381Medium· 6.5Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response
GHSA-6623-4q32-82v8Low· 4.7Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS
GHSA-55cm-p4ww-685gMedium· 5.3Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()