Prototype pollution in hono - CVE-2026-56763
Published: July 24, 2026
Vulnerability identifier: #VU139311
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56763
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify data in application objects.
The vulnerability exists due to improper input validation in parseBody({ dot: true }) when parsing specially crafted form field names using dot notation. A remote attacker can send specially crafted form fields such as __proto__.x to disclose sensitive information and modify data in application objects.
Exploitation requires the application to later merge the parsed result into regular JavaScript objects using unsafe merge patterns.
Affected software
hono
How to mitigate CVE-2026-56763
Install security update from vendor's website.
hono - update to 4.12.7