CVE-2026-56763

Name: CVE-2026-56763 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-56763

MEDIUM

CVSS v3.1: 4.8

NetworkNo privilegesNo user interactionVendor advisory ref

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: MEDIUM
CVSS: 4.8 v3.1 · NVD
EPSS: EPSS not provided by FIRST.org for this CVE
CISA KEV: No
Attack conditions (CVSS vector): NetworkNo privilegesNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (2)

CVSS / EPSS / KEV

CVSS v3.1 4.8 / 10 MEDIUM Source: NVD

CVSS v4.0 6.3 / 10 MEDIUM Source: NVD

EPSS — EPSS not provided by FIRST.org for this CVE Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.

Record details

CVE ID: CVE-2026-56763
CVSS (v3.1): 4.8 (MEDIUM)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability subscore: 2.2
Impact subscore: 2.5
CISA KEV: No
Weakness (CWE): CWE-1321
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Vendor advisory https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223
Vendor advisory https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-w…

← Back to all records