EUVD-2026-77113

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

NPM: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

NPM: Hono: Unbounded dot-notation nesting in parseBody can cause memory exhaustion vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

GHSA-G6GW-C38X-MQFC Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...

EUVD-2026-69611

Hono: Unbounded dot-notation nesting in parseBody can cause memory exhaustion...

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...

expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution

A flaw was found in libexpat, a software library used for parsing XML Extensible Markup Language documents. An attacker could exploit an integer overflow vulnerability in the xmlwf utility by crafting malicious NOTATION declarations. This could lead to the disclosure of sensitive information or...

Asymmetric Resource Consumption (Amplification)

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification in the parseBody function, which expands dot-separated form field names into nested objects without limiting nesting depth or total object...

CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84364

Hono is a JavaScript web application framework supporting any runtime. Prior to 4.13.5 , the parseBody() function, when dot-notation parsing is enabled, does not limit nesting depth or the number of intermediate objects created from dot-separated form field names. A single deeply dotted field nam...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

CVE-2026-84364: Uncontrolled Resource Consumption

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...

PT-2026-84502

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5 Description When dot-notation parsing is enabled, the parseBody function fails to limit the nesting depth or the total number of intermediate objects created when expanding dot-separated form field names into nest...

CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

CVE-2026-66003

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0 , an access control bypass in the REST API allows a low-privileged authenticated user to read data from Linked DocTypes they are not authorized to access. The root cause is that when a doc...

CVE-2026-66003 Frappe: Access control bypass via REST API dot-notation fields on linked doctypes

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the Twig rendering process. An attacker can access sensitive configuration values by leveraging page-content edit...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...