CyberRota Analysis
AI-GeneratedHono versions prior to 4.12.7 are vulnerable to prototype pollution due to improper handling of the __proto__ key in form field names when the dot option is enabled. This flaw allows attackers to manipulate object behavior by merging parsed results into existing JavaScript objects using unsafe patterns. Developers and organizations utilizing Hono in their Java applications should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.