CVE-2026-56763

CVE-2026-56763CVE-2026-56763

Description

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

Scoring

CVSS 4.8 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Last modified2026-07-11
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.