CVE-2026-84364 in Hono
Summary
by MITRE • 09/02/2026
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Hono versions prior to 4.13.5 represents a significant resource exhaustion risk rooted in the framework's handling of form data parsing, specifically when dot-notation expansion is enabled for nested object construction. This flaw allows an unauthenticated attacker to trigger a Denial of Service condition by exploiting the lack of constraints on nesting depth and intermediate object creation during body parsing operations. The core technical issue lies in how parseBody() processes field names containing multiple dots; rather than treating them as simple string keys, the function recursively expands these into deeply nested JavaScript objects. Crucially, empty segments within these dotted paths are preserved, meaning that a single byte of input can contribute to an additional level of nesting or object instantiation without adding substantial payload size relative to the resulting memory footprint.
From a technical perspective, this behavior creates a severe amplification effect where small request bodies result in disproportionately large allocations on the JavaScript heap. An attacker can craft requests with either deeply nested field names using dot notation or a high volume of shallowly dotted fields that collectively generate thousands of intermediate objects. Because Hono accepts the entire body into memory before processing, the server must allocate resources for this expanded object graph immediately upon receipt. This mechanism bypasses typical size-based protections since the raw input remains within normal limits while the internal representation balloons to consume excessive amounts of RAM and CPU cycles during traversal and construction.
The operational impact of this vulnerability is severe, leading directly to service unavailability through heap exhaustion. When an attacker sends concurrent requests designed to trigger this parsing behavior, the Node.js event loop becomes blocked or overwhelmed by garbage collection pressure as it attempts to manage the massive object graph. This results in the termination of the server process due out-of-memory errors or extreme latency that renders the application effectively unreachable for legitimate users. The attack requires no authentication and can be executed remotely against any endpoint configured with dot-notation parsing enabled, making it a high-severity threat to availability.
This vulnerability aligns with CWE Category 787: Out-of-bounds Write in terms of memory allocation abuse, though more specifically it falls under CWE Category 400: Uncontrolled Resource Consumption and CWE Category 1325: Improperly Controlled Sequential Memory Allocation. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1496: Resource Hijacking, where an attacker consumes computational resources to degrade service performance or availability. It also relates to T1059: Command and Scripting Interpreter if viewed through the lens of exploiting interpreter-side effects for denial of service.
Mitigation strategies primarily involve upgrading Hono to version 4.13.5 or later, which implements strict limits on nesting depth and total object count during parsing. For applications unable to upgrade immediately, developers should ensure that dot-notation parsing remains disabled in the configuration settings, as this feature is not enabled by default. Additionally, implementing rate limiting at the network level can help mitigate the impact of concurrent attack vectors designed to exhaust server resources. Input validation middleware that restricts field name complexity or length prior to reaching the body parser provides an additional layer of defense against such amplification attacks.