THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-g6gw-c38x-mqfc (medium) — Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

[GHSA] GHSA-g6gw-c38x-mqfc (medium) — Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

medgithub_advisoriesPublished 2026-09-08

GHSA-g6gw-c38x-mqfc Severity: medium CVE: CVE-2026-84364

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

### Summary

When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far l

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-g6gw-c38x-mqfc