PT-2026-57431 · Hono · Hono

0Xkakash1 · Published 2026-03-11 · Updated 2026-07-11 · CVE-2026-56763

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.7

Description The parseBody() function allows the use of the proto key when the dot option is enabled. This allows specially crafted form field names to create objects containing proto properties. If these parsed results are merged into regular JavaScript objects using unsafe merge patterns, it can lead to prototype pollution, which allows an attacker to modify object behavior.

Recommendations Update Hono to version 4.12.7 or later. As a temporary mitigation, disable the dot option in the parseBody() function.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-56763

GHSA-V8W9-8MX6-G223

Affected Products

Hono

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json · Exploit
• https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56763 · Security Note
• https://osv.dev/vulnerability/CVE-2026-56763 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe · Note
• https://twitter.com/CVEnew/status/2076040497936711745 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076042821363007578 · Twitter Post
• https://vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option · Note