Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84364— Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Quick assessment

Affected
honojs hono
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hono 是一个支持任意 JavaScript 运行时环境的 Web 应用框架。在 4.13.5 之前的版本中，当启用点号分隔的表单字段名解析（dot-notation parsing）时， 会将以点分隔的字段名扩展为嵌套对象，但未对嵌套深度或创建的中间对象总数设置限制。由于空段会被保留，单个带有大量点号的字段名可以通过每个字节引入一层嵌套；而包含大量浅层点号字段的请求体也能产生类似的内存放大效应。因此，一个处于正常大小限制内的请求体在被接受后，可能分配出远大于请求体本身大小的对象图。能够访问受影响端点的未认证攻击

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84364

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
honojs hono < 4.13.5 -

II. Public POCs for CVE-2026-84364

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84364

请登录查看更多情报信息。

Other References for CVE-2026-84364 (3)

Same Patch Batch · honojs · 2026-09-01 · 3 CVEs total

CVE-2026-84365 6.5 MEDIUM Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output d
CVE-2026-84363 5.9 MEDIUM Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy in

IV. Related Vulnerabilities

Same product: hono
Same vendor: honojs
Same weakness: CWE-400

V. Comments for CVE-2026-84364

No comments yet

Leave a comment