This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references.

Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.