SB2026072457 - Prototype pollution in hono

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072457

SB2026072457 - Prototype pollution in hono

Published: July 24, 2026

Security Bulletin ID SB2026072457
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Prototype pollution (CVE-ID: CVE-2026-56763)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify data in application objects.

The vulnerability exists due to improper input validation in parseBody({ dot: true }) when parsing specially crafted form field names using dot notation. A remote attacker can send specially crafted form fields such as __proto__.x to disclose sensitive information and modify data in application objects.

Exploitation requires the application to later merge the parsed result into regular JavaScript objects using unsafe merge patterns.


Remediation

Install update from vendor's website.

References