Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Hono allows crafted form fields to alter object prototypes

published 3 months ago

Summary

Versions of Hono older than 4.12.7 let specially named form fields create __proto__ entries when parsing request bodies. This can let an attacker change the behavior of objects used by your application, potentially affecting data handling. Update Hono to version 4.12.7 or later to stop this risk.

What to do

Update GitHub Actions hono to version 4.12.7 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	hono	< 4.12.7

Original advisory text

Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references.

## Original Description

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.3 Medium

Type

CWE-1321Prototype Pollution

Timeline

Published11 Jul 2026

Updated2 Oct 2026

First seen2 Oct 2026

Sources

GHSA-3wcj-gjvf-fvch · GHSA

Track software like this

Free during beta