Hono, a JavaScript web framework, contains a flaw in the parseBody() method when dot-notation parsing is enabled: the framework does not cap the depth of nested objects derived from dotted field names. An attacker can craft a single request body with many deeply nested or numerous dotted fields, causing the server to allocate a vastly larger object graph than the original payload. The resulting exhaustion of the JavaScript heap can terminate the process, leaving the service unavailable until a restart.

Versions of Hono prior to 4.13.5 that use parseBody() with dot-notation parsing enabled are impacted. By default, dot-notation is disabled, so applications that have not explicitly enabled it remain safe. Configurations that set dot-notation to true or rely on the framework's default parsing will be vulnerable.

The CVSS score of 5.3 classifies this vulnerability as moderate severity. The EPSS score is not provided, but the scenario requires an unauthenticated attacker able to reach a vulnerable endpoint and send concurrent requests. Successful exploitation results in a denial of service due to heap exhaustion. The vulnerability is not listed in CISA's KEV catalog, indicating no identified large-scale exploitation yet.