CVE-2026-56763: Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
honoto a version that resolves this vulnerability.Fixed in 4.12.7 - Configuration
Disable the parseBody dot option so that specially crafted form field names that include __proto__ are not interpreted into objects.
Hono parseBody dot option = disabled - Compensating control
Avoid merging parsed results into regular JavaScript objects using unsafe merge patterns; use safe merging that does not allow __proto__-based prototype mutation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56763?
CVE-2026-56763 has a severity rating of medium at 6.3.
How do I fix CVE-2026-56763?
To fix CVE-2026-56763, upgrade to Hono version 4.12.7 or later where the vulnerability is addressed.
What type of attack does CVE-2026-56763 enable?
CVE-2026-56763 enables prototype pollution attacks through specially crafted form field names.
Which software is affected by CVE-2026-56763?
The affected software for CVE-2026-56763 is Hono, specifically versions prior to 4.12.7.
When was CVE-2026-56763 published?
CVE-2026-56763 was published on July 11, 2026.