CVE-2026-84364

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5

Description When dot-notation parsing is enabled, the parseBody() function fails to limit the nesting depth or the total number of intermediate objects created when expanding dot-separated form field names into nested objects. Because empty segments are preserved, a single deeply dotted field name or numerous shallowly dotted fields can cause significant memory amplification. This allows an unauthenticated attacker to send concurrent requests that exhaust the JavaScript heap, leading to server process termination and service unavailability. Dot-notation parsing is not enabled by default.

Recommendations Update to version 4.13.5. As a temporary mitigation, disable dot-notation parsing in the parseBody() function.