CVE-2026-84364

Received Received - Intake

Hono Framework Heap Exhaustion via Dot-Notation Parsing

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84364

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Hono, a JavaScript web framework. When parseBody() processes form fields with dot-separated names and dot-notation parsing is enabled, it does not restrict nesting depth or object creation. Attackers can exploit this by sending deeply nested or numerous dotted field names to cause excessive memory allocation, leading to JavaScript heap exhaustion and server crashes.

Detection Guidance

To detect this vulnerability, monitor for unusually high memory usage or crashes in Hono applications running versions before 4.13.5. Check for requests with deeply nested dot-separated form fields. Use tools like 'top' or 'htop' to observe memory consumption spikes during request processing.

Impact Analysis

An unauthenticated attacker could send malicious requests to exhaust server memory, causing the service to become unavailable until restarted. This leads to denial-of-service conditions, disrupting normal operations for all users relying on the affected application.

Compliance Impact

This vulnerability could impact compliance by causing service unavailability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime may lead to data processing interruptions, affecting integrity and accessibility of sensitive data.

Mitigation Strategies

Upgrade Hono to version 4.13.5 or later immediately. If upgrading is not possible, disable dot-notation parsing in the parseBody() configuration. Implement rate limiting to prevent excessive concurrent requests. Monitor server memory usage closely after applying fixes.

Hi! I’m here to help you understand CVE-2026-84364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70