CVE-2026-84364: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.13.5 - Configuration
Ensure dot-notation parsing is disabled, since applications using the default behavior are not affected; the issue occurs when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled (prior to 4.13.5).
Hono parseBody() dot-notation parsing = not enabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Hono versions before 4.13.5 are exposed only if they enable dot-notation parsing when calling parseBody(). Applications using the default behavior are not affected.
What does an attacker need to exploit it?
An attacker needs network access to an affected endpoint that processes request bodies with dot-notation parsing enabled. No authentication or user interaction is required.
What is the practical impact of exploitation?
An attacker can submit concurrent requests containing deeply dotted field names or many shallow dotted fields, causing excessive object allocation. This can exhaust the JavaScript heap, terminate the server process, and make the service unavailable until it is restarted.
What should be done if immediate patching is not possible?
Disable dot-notation parsing for parseBody() where possible, since the default behavior is not affected. Restrict access to affected endpoints until the application can be updated.
How can I determine whether an application is affected?
Check whether the application uses a Hono version earlier than 4.13.5 and enables dot-notation parsing for parseBody(). If dot-notation parsing is not enabled, the application is not affected.