CVE-2026-84364: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

September 8, 2026

When parseBody() expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.

References

github.com/advisories/GHSA-g6gw-c38x-mqfc
github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178
github.com/honojs/hono/releases/tag/v4.13.5
github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc
nvd.nist.gov/vuln/detail/CVE-2026-84364

Code Behaviors & Features

Detect and mitigate CVE-2026-84364 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →