{"id":"EUVD-2026-43173","enisaUuid":"f636b5a1-adef-3abd-b876-bf56de3a8ffd","description":"Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","datePublished":"Jul 11, 2026, 1:00:59 PM","dateUpdated":"Jul 14, 2026, 2:30:12 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223\nhttps://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option\n","aliases":"CVE-2026-56763\nGHSA-3wcj-gjvf-fvch\n","assigner":"VulnCheck","epss":0.27,"enisaIdProduct":[{"id":"6fe00474-1981-3100-a214-1837239ab8a8","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"0 \u003c4.12.7"}],"enisaIdVendor":[{"id":"7af9f923-5386-316f-8a33-55e4320d1471","vendor":{"name":"Hono"}}],"enisaIdVulnerability":[{"id":"830088d1-b633-3fbf-ac19-8a802561852a","vulnerability":{"id":"CVE-2026-56763","description":"Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","datePublished":"Jul 11, 2026, 1:00:59 PM","dateUpdated":"Jul 14, 2026, 2:30:12 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223\nhttps://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option\n","enisa_id":"EUVD-2026-43173\n","assigner":"VulnCheck","epss":0.27,"dataProcessed":"Nov 5, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"5835fdae-62cd-3ee7-82e5-9b832d250948","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"0 \u003c4.12.7"}],"vulnerabilityVendor":[{"id":"4f0277a7-b564-36db-ae7c-b72e9e59c815","vendor":{"name":"Hono"}}]}},{"id":"d8e99613-a060-32ff-a4d6-58b5e17819b6","vulnerability":{"id":"GHSA-3wcj-gjvf-fvch","description":"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","datePublished":"Jul 11, 2026, 3:30:23 PM","dateUpdated":"Oct 2, 2026, 10:35:59 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56763\nhttps://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option\n","enisa_id":"EUVD-2026-43173\n","aliases":"GHSA-3wcj-gjvf-fvch\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}