Denial of Service in Hono Web Application Framework by Hono

CVE-2026-84364

What is CVE-2026-84364?

The Hono Web application framework, prior to version 4.13.5, is susceptible to a Denial of Service attack due to insufficient validation in the parseBody() function. This function's dot-notation parsing capability allows for unlimited nesting of objects, potentially creating vast object graphs that can overwhelm the JavaScript heap. An unauthenticated attacker could exploit this vulnerability by sending multiple requests to an affected endpoint, leading to server process termination and service disruption. Default configurations do not enable dot-notation parsing, which mitigates exposure for applications not intentionally utilizing this feature. Version 4.13.5 includes fixes addressing this issue.

References