Hono CVE-2026-84364

Exploitation requires that the target Hono application explicitly calls parseBody() with the { dot: true } option - this is a non-default, opt-in setting that must be deliberately enabled by the developer. Applications using the default parseBody() behavior without dot-notation are completely unaffected. Given the CVSS vector PR:N, no authentication is required once an affected endpoint is identified. The attacker must be able to reach the target endpoint over the network and submit POST requests with form-encoded bodies. The limiting factors are: (1) dot-notation must be explicitly enabled - not common in all deployments; (2) the attack is most effective with concurrent requests to amplify heap pressure before the process terminates; (3) no special authentication, user interaction, or platform-specific condition is required beyond the opt-in configuration.

The NVD CVSS score of 5.3 (A:L) understates the operational impact: the description explicitly describes server process termination requiring restart, which maps to A:H rather than A:L under CVSS 3.1 definitions. The attack vector is network (AV:N), no authentication is required (PR:N), and no user interaction is needed (UI:N), making exploitation trivially automatable via concurrent HTTP POST requests. EPSS data and KEV status are not available in the provided intelligence, so active exploitation cannot be confirmed; no public exploit code has been identified at time of analysis. The most significant limiting factor is that dot-notation parsing is not enabled by default - only applications that explicitly pass { dot: true } to parseBody() are exposed, which meaningfully narrows the real-world attack surface. SSVC signals suggest: exploitation status unknown, automatable, technical impact is total availability loss to the affected process. Despite the moderate published score, any operator running Hono with dot-notation enabled - whether a large SaaS provider or a smaller team - should treat this as a high-priority patch given how trivially the process can be crashed with a single malformed request.

An attacker discovers a Hono API endpoint that parses multipart or URL-encoded form data with dot-notation enabled. The attacker sends concurrent POST requests, each containing a form field key with 33 or more dot-separated segments (e.g., a.a.a...a=x with 33 levels), causing parseBody() to attempt construction of a 33-deep nested object graph per request. With enough concurrent connections, the JavaScript runtime heap is exhausted and the server process crashes, rendering the service unavailable to all users until the process is restarted.