Hono EUVD-2026-43173

Three concurrent conditions must be present for exploitation: (1) the target Hono route must call parseBody with the 'dot' option explicitly set to true - this is a non-default setting that must be deliberately opted into by the developer; (2) the application must pass the parsed body result into a plain JavaScript object merge using an unsafe pattern such as recursive Object.assign, lodash _.merge, or an equivalent custom deep-merge function that does not filter '__proto__'; and (3) the attacker must be able to send HTTP requests with attacker-controlled form body content to that endpoint (Content-Type: application/x-www-form-urlencoded or multipart/form-data). Exploitation is not possible against Hono routes that use the default parseBody configuration (dot:false), against endpoints that validate or sanitize parsed keys before merging, or against applications using prototype-safe merge patterns. The CVSS 4.0 AT:P metric confirms the presence of a specific attack prerequisite beyond mere network access.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N) accurately encodes the dual constraints limiting real-world exploitability: high attack complexity and a specific attack prerequisite (AT:P) requiring both the non-default dot:true parseBody configuration AND an unsafe downstream merge pattern in application code. Neither condition is present in default Hono deployments, making the actual attack surface narrower than the network-accessible delivery vector might suggest. Impact is bounded at VC:L/VI:L - prototype pollution in JavaScript server contexts can enable logic bypasses and subtle data leakage but direct code execution is uncommon without a specific gadget chain. No EPSS score is provided in the input data; given the absence of KEV listing or public POC, opportunistic mass exploitation is unlikely. SSVC factors are not explicitly provided, but automatability is constrained by the AT:P prerequisite, reducing spray-and-pray viability. This is a meaningful vulnerability for Hono applications using dot:true with unsafe merge patterns, but not a broadly exploitable critical issue across all Hono deployments.

An attacker submits an HTTP POST request with Content-Type application/x-www-form-urlencoded to a Hono endpoint that calls parseBody with { dot: true }, encoding a field such as '__proto__[isAdmin]=true' in the body. Hono deserializes this into a nested object with a __proto__ property, and when the application merges the result using an unsafe deep merge, Object.prototype.isAdmin becomes true for all plain objects in the process - causing downstream authorization checks like 'if (user.isAdmin)' to pass for any user. No public POC exploit code has been identified at time of analysis.