Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/GHSA-V8W9-8MX6-G223.md

Created March 11, 2026 05:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/ebad4ba77668bb561825692b022ec277 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/ebad4ba77668bb561825692b022ec277 to your computer and use it in GitHub Desktop.
Download ZIP
GHSA-V8W9-8MX6-G223: GHSA-v8w9-8mx6-g223: Prototype Pollution in Hono parseBody Utility - CVE Security Report
Raw
GHSA-V8W9-8MX6-G223.md

GHSA-V8W9-8MX6-G223: GHSA-v8w9-8mx6-g223: Prototype Pollution in Hono parseBody Utility

CVSS Score: 6.5 Published: 2026-03-11 Full Report: https://cvereports.com/reports/GHSA-V8W9-8MX6-G223

Summary

The Hono web framework contains a Prototype Pollution vulnerability (CWE-1321) within its parseBody utility. When the { dot: true } configuration option is enabled, insufficient validation of form data keys allows unauthenticated attackers to inject arbitrary properties into the global Object.prototype. This manipulation affects all objects within the Node.js runtime environment.

TL;DR

Hono versions prior to 4.12.7 are vulnerable to Prototype Pollution via the parseBody utility when dot: true is enabled. Attackers can pollute the global object prototype by sending crafted form data keys such as __proto__.polluted, potentially leading to Denial of Service or unauthorized property manipulation.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-1321
  • Attack Vector: Network
  • Authentication Required: None
  • CVSS Score: 6.5 (Medium)
  • Affected Component: parseBody utility
  • Fix Commit: ef902257e0beacbb83d2a9549b3b83e03514a6fe

Affected Systems

  • Hono web framework versions prior to 4.12.7
  • Node.js applications utilizing Hono's parseBody with the dot configuration enabled
  • hono: < 4.12.7 (Fixed in: 4.12.7)

Mitigation

  • Upgrade the hono package to version 4.12.7 or a newer stable release.
  • Disable the dot-notation parsing feature by explicitly omitting the { dot: true } option or setting it to { dot: false } if nested object parsing is not strictly required.
  • Implement application-level input validation to sanitize or reject incoming request keys containing 'constructor' or 'prototype'.

Remediation Steps:

  1. Identify all instances within the codebase where parseBody is invoked with { dot: true }.
  2. Update the hono dependency in package.json to ^4.12.7.
  3. Execute npm install or the equivalent package manager command to pull the patched version.
  4. Run the application test suite to ensure the updated parsing logic does not break expected form processing functionality.
  5. Deploy the updated application to all environments.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment