Prototype Pollution Vulnerability in Hono Package
Summary
GHSA-v8w9-8mx6-g223: When using parseBody({ dot: true }) in HonoRequest, specially crafted form field names such as proto.x could create objects containing a proto property. Affects hono versions < 4.12.7. Fixed in 4.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hono is a lightweight web framework for building web applications and APIs in Node.js. It is designed for performance and simplicity, allowing developers to create robust applications with minimal overhead. The framework supports features like middleware, routing, and request handling, making it a popular choice for developers. However, a recent vulnerability has been identified that allows for prototype pollution through the use of specially crafted form field names when using the parseBody function.
Vulnerability Detail
The vulnerability arises from the parseBody({ dot: true }) function in HonoRequest, which allows the creation of nested objects from form field names. Specifically, the function does not filter out the proto path segment, enabling attackers to craft keys like proto.x that can produce objects containing proto properties. This can lead to prototype pollution if the parsed data is merged into regular JavaScript objects using unsafe merge patterns, potentially compromising the integrity of the application.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.12.7
This is the first release that contains the fix.
npm install hono@4.12.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the parseBody({ dot: true }) function with untrusted input. Additionally, ensure that any merging of parsed data into existing objects is done using safe merge patterns that do not allow prototype pollution.
Conclusion
The prototype pollution vulnerability in the Hono package poses a risk to applications that merge parsed form data into regular objects using unsafe patterns. It is crucial to update to the patched version 4.12.7 or later to mitigate this risk. Additionally, employing safe coding practices can help prevent such vulnerabilities in the future.
See every vulnerability recorded for hono →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unauthorized access or modification of properties and methods.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If exploited, this vulnerability can allow attackers to alter the behavior of your application by modifying the prototype of objects, which can lead to data leakage, application crashes, or other malicious actions.
To prevent similar vulnerabilities, always validate and sanitize user input, and use libraries that have been audited for security issues. Additionally, keep your dependencies up to date.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
