AIKIDO-2026-759995
hono is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
honoTL;DR
Hono's parseBody() expands dot-separated form field names into nested objects when dot notation is enabled. The expansion is unbounded, so each dot in a field name creates another intermediate object and a short field name can allocate a disproportionately large object graph relative to the request size. Repeated or concurrent requests using such field names can exhaust process memory and terminate the server. The patch bounds nesting depth and object creation during dot-notation parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you call parseBody() with dot notation enabled.
Background info
hono is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 4.13.4.
How to fix this
Upgrade the hono library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.