CVE-2026-84364 Overview
Hono is a lightweight web application framework designed to run across any JavaScript runtime. A resource exhaustion vulnerability affects Hono versions prior to 4.13.5 when applications enable dot-notation parsing in parseBody(). The function expands dot-separated form field names into nested objects without enforcing limits on nesting depth or the total number of intermediate objects created. An unauthenticated attacker can send a modestly sized request body that inflates into a massive in-memory object graph, exhausting the JavaScript heap and terminating the server process. Applications relying on the default parseBody() behavior are not affected.
Critical Impact
Unauthenticated attackers can crash Hono server processes through concurrent requests, leaving services unavailable until manual restart.
Affected Products
- Hono framework versions prior to 4.13.5
- Applications using parseBody() with dot-notation parsing explicitly enabled
- JavaScript runtimes hosting affected Hono deployments (Node.js, Bun, Deno, Cloudflare Workers)
Discovery Timeline
- 2026-09-01 - CVE-2026-84364 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84364
Vulnerability Analysis
The flaw resides in the parseBody() utility inside src/utils/body.ts. When dot-notation parsing is enabled, Hono converts form field names such as a.b.c.d into nested JavaScript objects. The parser does not cap the recursion depth or the cumulative count of intermediate objects created across the request body.
Empty segments are preserved during expansion. A single deeply dotted field name can therefore encode one nesting level per byte submitted. Alternatively, a large collection of shallowly dotted fields can produce equivalent amplification across a single request. The classification aligns with CWE-400: Uncontrolled Resource Consumption.
A request body that passes normal size validation can allocate an object graph far larger than the raw payload. Concurrent requests compound the memory pressure and terminate the Node.js or runtime process.
Root Cause
The parser lacked bounded input handling for two dimensions: maximum nesting depth per key and total number of intermediate objects generated per request. Body-size limits alone do not prevent amplification because expansion happens after the body has been accepted.
Attack Vector
An unauthenticated remote attacker sends HTTP requests containing crafted form field names with excessive dot-separated segments. The requests target any endpoint that invokes parseBody() with dot-notation parsing enabled. Sustained concurrent requests exhaust the JavaScript heap and crash the process.
// Security patch in src/utils/body.ts (v4.13.5)
import type { HonoRequest } from '../request'
import { bufferToFormData } from './buffer'
+const MAX_NESTING_DEPTH = 32
+const MAX_NESTED_OBJECTS = 10_000
+
type BodyDataValueDot = { [x: string]: string | File | BodyDataValueDot }
type BodyDataValueDotAll = {
[x: string]: string | File | (string | File)[] | BodyDataValueDotAll
Source: Hono commit 531e9c5. The patch introduces hard ceilings of 32 nesting levels and 10,000 total nested objects per parsed body.
Detection Methods for CVE-2026-84364
Indicators of Compromise
- Repeated Node.js or runtime process crashes accompanied by JavaScript heap out of memory errors
- HTTP request bodies containing form field names with unusually high counts of dot separators
- Spikes in memory allocation immediately following requests to endpoints that call parseBody()
- Concurrent inbound requests from a single source with abnormal Content-Length to processing-time ratios
Detection Strategies
- Inspect application dependency manifests for Hono versions below 4.13.5 and flag deployments where parseBody({ dot: true }) or equivalent options are set
- Deploy a web application firewall rule that blocks form field names exceeding a reasonable dot-segment threshold, for example 32 segments
- Correlate HTTP request logs with process restart events to identify request patterns that precede service termination
Monitoring Recommendations
- Track V8 heap usage and garbage-collection pause duration on Hono-based services
- Alert on process exit codes indicating out-of-memory termination in container orchestrators
- Log the length and structure of form field names on endpoints that consume parsed bodies
How to Mitigate CVE-2026-84364
Immediate Actions Required
- Upgrade Hono to version 4.13.5 or later across all deployments
- Audit application code for calls to parseBody() that enable dot-notation parsing
- Place a reverse proxy or WAF in front of affected endpoints to reject requests with excessive dot-separated field names
Patch Information
The fix ships in Hono v4.13.5. The patch adds MAX_NESTING_DEPTH = 32 and MAX_NESTED_OBJECTS = 10_000 constants to src/utils/body.ts. Refer to the GitHub Security Advisory GHSA-g6gw-c38x-mqfc for full details.
Workarounds
- Disable dot-notation parsing by using the default parseBody() behavior, which is not affected
- Enforce a maximum request body size well below runtime memory capacity at the ingress layer
- Rate-limit unauthenticated requests to endpoints that parse form bodies to reduce amplification impact
# Upgrade Hono to the patched release
npm install hono@4.13.5
# Verify installed version
npm ls hono
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
