CVE-2026-56763 Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option
Attackers can achieve prototype pollution in Hono web applications by exploiting the parseBody dot option, potentially leading to code execution or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56763?
CVE-2026-56763 is a medium-severity vulnerability in Hono, published on 11 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
Weakness: CWE-1321
Which versions are affected by CVE-2026-56763?
2 open source packages ship an affected version, including hono.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.12.7 |
hono npm | All versions | 4.12.7 |
How do I fix CVE-2026-56763?
Upgrade hono to 4.12.7 or later.
Is CVE-2026-56763 being exploited?
There is no known exploitation of CVE-2026-56763 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-UG01893, GHSA-v8w9-8mx6-g223, MINI-28gw-558v-g4p4, MINI-49rw-8x3h-mv2m, MINI-4v2q-94cp-rrxx, MINI-6jv7-28p2-2q9g and 3 more.