{"id":"EUVD-2026-43173","revision":"f60d535453c64c3fb6c32ecaea3ddf41","records":[{"revision":"f60d535453c64c3fb6c32ecaea3ddf41","observedAt":"2026-11-07T12:36:53.199+00:00","statement":{"source":"euvd","id":"EUVD-2026-43173","aliases":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch"],"title":"Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using un…","description":"Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43173","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 11, 2026, 1:00:59 PM","dateUpdated":"Jul 14, 2026, 2:30:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-43173","identifiers":["EUVD-2026-43173","CVE-2026-56763","GHSA-3wcj-gjvf-fvch"]},"retained":false,"historicalAffected":[]}],"coverage":[]}