CVE-2026-84364
Unbounded dot-notation nesting in parseBody() can cause memory exhaustion
Honoの parseBody() におけるドット表記のネスト無制限によるメモリ不足を引き起こす脆弱性
In Hono, when parseBody() expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.
Disclosure Date
2026/09/01
Credit
Riku Masukawa / Rikuxx(https://x.com/Rikuxx00)