CVE-2026-56763: Improperly Controlled Modification of Object Prototype Attributes

Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve...

CVE-2026-25047: Improperly Controlled Modification of Object Prototype Attributes

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8...

Prototype Pollution

@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...

CVE-2024-38998

A flaw was found in RequireJS. This flaw allows an attacker to alter the behavior of all objects inheriting from the affected prototype by passing arguments to the config function crafted with the built-in property: proto. This issue can potentially lead to a denial of service, remote code...