CVE-2026-56763CWE-1321

Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option

Medium · published July 11, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00273 · 18.6th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-07-11T13:00Z
EPSS history
Timeline
  • 11 JUL 13:00Z
    Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
    cvelistv5