The vulnerability allows the __proto__ key to be processed in body parsing when the dot option is enabled, leading to prototype pollution when the parsed results are merged into objects using unsafe merge patterns. This can alter the prototype chain of built‑in or custom objects, potentially changing the behavior of all instances of that constructor throughout the application. The impact is therefore the ability to modify application logic or data handling, which may create a vector for additional attacks, though no direct remote code execution is indicated.

The issue is present in Hono versions older than 4.12.7 when the parseBody middleware is configured with the dot option enabled. The affected application runs on Node.js environments, as indicated by the associated CPE. No specific Node.js version constraints are listed; the vulnerability depends on the library version.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA's KEV catalog, suggesting no known publicly reported exploits. Attackers would need to send a crafted HTTP request containing form fields whose names include __proto__ while the dot option is active. The resulting prototype pollution can affect all instances of affected constructors, providing a foundation for further attacks, but exploitation requires an application that merges parsed data into objects using unsafe merge patterns.