GHSA-v8w9-8mx6-g223: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
When using parseBody({ dot: true }) in HonoRequest, specially crafted form field names such as __proto__.x could create objects containing a __proto__ property.
If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.
References
Code Behaviors & Features
Detect and mitigate GHSA-v8w9-8mx6-g223 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →