Hono versions older than 4.12.7 accept the __proto__ key during body parsing when the dot option is enabled, producing data that is merged into JavaScript objects using unsafe merge patterns. This allows an attacker to set an object's __proto__ property, polluting prototypes and altering the behavior of every instance of that constructor. While the description does not state direct remote code execution, such manipulation can create a vector for further exploitation.

The vulnerability is present in any older than version 4.12.7 and that configures parseBody with the dot option enabled. The affected application runs on Node.js environments, as indicated by the associated CPE. No specific Node.js version requirement is stated.

The CVSS score of 6.3 indicates moderate severity. An EPSS indicates a very low but non‑zero exploitation probability, and the issue is not listed in CISA’s KEV catalog, suggesting no publicly reported exploits at present. Based on the description, it is inferred that the most likely attack scenario involves a remote attacker sending a crafted HTTP request with form fields that include __proto__ while the dot option is active. The resulting prototype pollution can modify object behavior across the application and may enable further attacks.