CVE-2026-84364: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Summary
When parseBody() expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.
Details
Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could encode one nesting level per byte.
Both shapes produce the effect: a single deeply dotted field name, and a large number of shallowly dotted ones within one body. A request body size limit does not prevent it, because the amplification happens after the body has been accepted.
Dot-notation parsing is not enabled by default.
Impact
An attacker who can reach an endpoint that parses request bodies with dot-notation enabled can send concurrent requests whose memory cost is disproportionate to their size.
This may lead to:
- exhaustion of the JavaScript heap and termination of the server process - the service remaining unavailable until it is restarted
This issue affects applications that explicitly enable dot-notation parsing. Applications using the default behaviour are not affected.
Other sources
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/honoto a version that resolves this vulnerability.Fixed in 4.13.5 - Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.13.5 - Configuration
Ensure dot-notation parsing is not enabled, since dot-notation parsing is not enabled by default; applications that explicitly enable it are affected by unbounded nesting in parseBody().
Hono parseBody() dot-notation parsing (enabled/disabled) = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Hono versions before 4.13.5 are exposed only if they enable dot-notation parsing when calling parseBody(). Applications using the default behavior are not affected.
What does an attacker need to exploit it?
An attacker needs network access to an affected endpoint that processes request bodies with dot-notation parsing enabled. No authentication or user interaction is required.
What is the practical impact of exploitation?
An attacker can submit concurrent requests containing deeply dotted field names or many shallow dotted fields, causing excessive object allocation. This can exhaust the JavaScript heap, terminate the server process, and make the service unavailable until it is restarted.
What should be done if immediate patching is not possible?
Disable dot-notation parsing for parseBody() where possible, since the default behavior is not affected. Restrict access to affected endpoints until the application can be updated.
How can I determine whether an application is affected?
Check whether the application uses a Hono version earlier than 4.13.5 and enables dot-notation parsing for parseBody(). If dot-notation parsing is not enabled, the application is not affected.