GHSA-g6gw-c38x-mqfc

Suggest an improvement
Source
https://github.com/advisories/GHSA-g6gw-c38x-mqfc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g6gw-c38x-mqfc/GHSA-g6gw-c38x-mqfc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g6gw-c38x-mqfc
Aliases
Downstream
CGA (86)
MINI (7)
Published
2026-09-08T21:23:02Z
Modified
2026-09-08T21:30:05Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Details

Summary

When parseBody() expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.

Details

Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could encode one nesting level per byte.

Both shapes produce the effect: a single deeply dotted field name, and a large number of shallowly dotted ones within one body. A request body size limit does not prevent it, because the amplification happens after the body has been accepted.

Dot-notation parsing is not enabled by default.

Impact

An attacker who can reach an endpoint that parses request bodies with dot-notation enabled can send concurrent requests whose memory cost is disproportionate to their size.

This may lead to:

  • exhaustion of the JavaScript heap and termination of the server process
  • the service remaining unavailable until it is restarted

This issue affects applications that explicitly enable dot-notation parsing. Applications using the default behaviour are not affected.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-08T21:23:02Z",
    "nvd_published_at":  "2026-09-01T21:18:47Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / hono

Package

Name
hono
View open source insights on deps.dev
Purl
pkg:npm/hono

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.13.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g6gw-c38x-mqfc/GHSA-g6gw-c38x-mqfc.json"