Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T21:18:47.317Z",
  "pubdate": "2026-09-01T21:18:47.317Z",
  "executiveSummary": "Hono is susceptible to a denial-of-service (DoS) vulnerability triggered by unbounded object graph expansion during the parsing of form body data.\nThe vulnerability arises within the parseBody() function when dot-notation parsing is explicitly enabled by the developer.\nAn unauthenticated attacker can exploit this by sending maliciously crafted, deeply nested dot-separated form field names, which forces the server to allocate an disproportionately large object graph compared to the size of the request body.\nThis behavior leads to JavaScript heap exhaustion, ultimately resulting in server process termination and service unavailability.\nThe vulnerability affects all Hono versions prior to 4.13.5 that utilize dot-notation parsing. Applications relying on the default configuration remain unaffected.\nThe primary risk is the ease of exploitation; an attacker requires only network reachability to the application endpoint to initiate concurrent requests that crash the runtime environment.",
  "technicalDetails": "The vulnerability is located within the parseBody() function of the Hono web framework. The root cause is the lack of recursion depth limits and resource constraints when transforming dot-separated form field names into nested JavaScript objects.\nWhen dot-notation parsing is enabled, the function processes strings containing periods (e.g., 'a.b.c.d') as keys for nested objects. The current implementation does not validate the depth of the nesting or the total count of intermediate objects instantiated during this process.\nAn attacker can exploit this via two primary vectors: deep nesting (e.g., 'a.b.c.d...') or high-cardinality shallow nesting (a large volume of keys). Because empty segments are preserved and the logic does not impose bounds, a relatively small HTTP request body can force the JavaScript engine to allocate an object structure that consumes significantly more memory than the original request payload.\nThe attack flow proceeds as follows: 1) The attacker identifies an endpoint utilizing parseBody() with dot-notation enabled. 2) The attacker submits a carefully crafted POST request containing fields designed to maximize recursive object allocation. 3) The parseBody() function recursively iterates through the dot-separated string, creating intermediate objects at each segment. 4) The cumulative memory footprint of these objects exceeds the available heap space for the Node.js or JavaScript runtime process.\nThe resulting heap exhaustion forces a garbage collection pressure state, followed by an out-of-memory (OOM) error, which terminates the server process. Because the server cannot process incoming requests during this crash cycle and requires a full restart, the impact is a complete loss of availability for the targeted service.\nThe vulnerability is specifically relevant in environments where Hono is deployed with custom configurations that override the default, safe behavior. Since no authentication is required to interact with public-facing web endpoints, the barrier to exploitation is minimal, and concurrent requests from an attacker can amplify the impact, causing rapid service degradation.\nThe issue is definitively addressed in Hono version 4.13.5, which introduces necessary constraints on parsing logic to prevent uncontrolled object creation."
}