Is there a patch available for CVE-2026-56763?

Yes, a patch is available for CVE-2026-56763. Update the affected software to the latest version immediately.

Hono CVE-2026-56763

Q: What is the CVSS score of CVE-2026-56763?

CVE-2026-56763 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43173 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-07-11 VulnCheck

GHSA-3wcj-gjvf-fvch

Information Disclosure Prototype Pollution Hono

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Network delivery via HTTP form body, but high complexity due to non-default dot:true config and unsafe merge precondition both required; no authentication or user interaction needed; limited C and I impact, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 14:15 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

78 npm packages depend on hono (64 direct, 14 indirect)

Ecosystem-wide dependent count for version 4.12.7.

DescriptionCVE.org

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

AnalysisAI

Prototype pollution in Hono before 4.12.7 enables unauthenticated remote attackers to inject properties into JavaScript's Object.prototype by submitting crafted form field names containing '__proto__' keys when the 'dot' option is enabled in parseBody. Exploitation is conditional - it further requires that application code merges parsed body output into plain JavaScript objects using unsafe merge patterns - but when both conditions are present, attackers can silently alter inherited object behavior across the entire runtime, potentially bypassing authorization checks or leaking sensitive data. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 reflects limited impact and the attack prerequisite of the non-default dot option being enabled.

Technical ContextAI

Hono (CPE: cpe:2.3:a:hono:hono:*:*:*:*:*:*:*:*) is a fast, lightweight web framework targeting JavaScript runtimes including Cloudflare Workers, Deno, Bun, and Node.js. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), located in the parseBody utility function. When the 'dot' option is enabled, Hono interprets dot-notation form field keys (e.g., 'a.b.c') as nested object paths. Because the parser does not block '__proto__' as a reserved key, a crafted field name such as '__proto__[isAdmin]=true' or '__proto__.polluted=1' passes through deserialization unfiltered. If the resulting parsed object is then merged into an application-managed plain object using an unsafe operation - recursive Object.assign, lodash _.merge, or custom deep-merge - the injected '__proto__' properties propagate up the JavaScript prototype chain and become globally inherited by all plain objects in the process. This is the classic prototype pollution sink pattern described in CWE-1321.

RemediationAI

Upgrade Hono to version 4.12.7 or later, which patches '__proto__' key handling in the parseBody function per the vendor advisory at https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223. If an immediate upgrade is not feasible, disable the 'dot' option in all parseBody invocations - omit it entirely or explicitly pass { dot: false }, since false is the default; note this will change how nested form fields are interpreted and may require application logic adjustments. As a complementary control, audit all code paths that merge parseBody output into plain objects and replace unsafe merge patterns (recursive Object.assign, lodash _.merge) with prototype-safe alternatives such as sanitizing keys against a blocklist including '__proto__', 'constructor', and 'prototype' before merging, or using JSON.parse(JSON.stringify(obj)) to strip non-enumerable prototype keys prior to any merge operation.