CVE-2026-84364

Executive Summary

CVE-2026-84364 is an unauthenticated resource-exhaustion (denial-of-service) vulnerability in the Hono web application framework, affecting all versions prior to 4.13.5. The flaw resides in the parseBody() utility when dot-notation parsing is explicitly enabled; an attacker can submit a request body that causes an unbounded expansion of intermediate objects, exhausting the JavaScript heap and crashing the server process. Only applications that explicitly enable dot-notation parsing are exposed; use of default configuration is not affected.

Technical Analysis

The vulnerability lies in the interaction between Hono's parseBody() function and dot-notation parsing (a non-default feature of the framework). When dot-notation parsing is enabled, the function interprets dot-separated segments in form field names as a path and constructs a nested object graph from those segments.

Two described attack vectors produce disproportionate memory consumption relative to the body size:

1. Depth amplification: A single field name containing many consecutive dot-separated segments—each segment being a single byte (empty segments are preserved)—causes the parser to allocate one nesting level per byte. A body within the normal size limit can therefore encode a deeply nested object structure that consumes far more heap memory than the raw request size.

2. Breadth amplification: A request containing many shallowly dotted field names (e.g., a.b, c.d, etc.) creates the same multiplication effect across the entire request, since each field name triggers allocation of intermediate objects along its path.

The critical design flaw is the absence of:

• A maximum nesting depth limit
• A limit on the total number of intermediate objects created per request

The expansion occurs after the request body has been accepted, meaning the server has already validated the request size and the amplification payload arrives within a normal content-length.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yields a base score of 5.3, reflecting: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and an availability impact of Low (A:L) with no confidentiality or integrity impact. It is important to note that although the CVSS availability impact is rated "Low," the NVD description explicitly states that the server process can terminate, resulting in service unavailability until restart.

The NVD description provides no code-level details (function signatures, class names, or internal parser logic beyond parseBody()). All high-level claims about object graph allocation and missing limits are derived directly from the description text.

Exploitation Scenarios

Threat Actor Profile: Unauthenticated remote attacker with network access to any Hono endpoint that calls parseBody() with dot-notation parsing enabled.

Attack Chain:

1. Reconnaissance / Target Identification: The attacker identifies a service running Hono versions < 4.13.5. Since the framework serves HTTP endpoints, the attacker can fingerprint the application through response headers (e.g., x-powered-by may reveal framework version) or through behavior differences in request parsing. The attacker must also determine whether dot-notation parsing is enabled—this may require probing with a test request containing a dotted field name and observing whether the server returns nested objects in responses or exhibits parsing-related behavior.

2. Vulnerability Triggering: The attacker constructs a multipart/form-data or application/x-www-form-urlencoded request body. With depth amplification, the body contains a single field whose name consists of a long sequence of single-byte segments separated by dots (e.g., a.b.c.d.e.f... repeated to the maximum allowed body size). With breadth amplification, the body contains thousands of short dotted field names (e.g., a.b=1&c.d=2&e.f=3...). The request remains within normal size limits.

3. Payload Execution: The crafted body is submitted to the exposed endpoint. parseBody() processes the field names with dot-notation expansion enabled. Each dot segment triggers allocation of a new intermediate object in the nested graph. Due to the absence of depth/count limits, the parser continues allocating until the JavaScript heap is exhausted. Since the allocation happens during request parsing (before the application handler logic runs), the memory exhaustion cannot be intercepted by application-level input validation.

4. Post-Exploitation Impact: The memory exhaustion terminates the Node.js (or other JavaScript runtime) process. The server becomes unavailable until manually restarted or until the process manager restarts it. Because the exploitation is trivially cheap in terms of bandwidth (small request size) and requires no authentication, the attacker can send concurrent requests to amplify the effect and achieve a distributed denial-of-service (DDoS)-like outcome even with a single machine or botnet.

Note: No public PoC or exploit code is currently available. The attack chain above is inferred strictly from the vulnerability description and the known behavior of parsing libraries that expand dot-notation into object graphs. Insufficient technical detail is available to specify exact request formats or byte counts.

Impact Assessment

Business Impact: This vulnerability enables a denial-of-service condition against any production application using Hono with dot-notation parsing enabled. The impact is purely availability-related (C:N/I:N/A:L per CVSS), but the practical impact may exceed the CVSS rating because the NVD description explicitly states that the server process terminates. For internet-facing services, this translates to direct revenue loss, SLA violations, and reputational damage. For internal services, it can disrupt business-critical workflows.

Affected Systems: Any Hono application on versions < 4.13.5 where the application developer explicitly enabled dot-notation parsing in parseBody() (or configured the framework to enable it globally). Applications using default Hono configuration are not vulnerable. The framework supports any JavaScript runtime (Node.js, Deno, Bun, Cloudflare Workers, etc.), so the affected surface spans all such runtimes where the feature is enabled.

Blast Radius: The attack surface is limited to exposed HTTP endpoints that call parseBody(). A successfully exploited instance results in a full server-process crash. In shared hosting or serverless environments, the crash may have cascading effects on other workloads on the same infrastructure if resource limits are not properly isolated. The amplification factor (request size vs. memory consumed) is significant enough to be considered a practical DoS vector without requiring a botnet.

CVSS Subscore Analysis: The A:L rating reflects that the availability impact is partial (a service crash), but since the process termination renders the service unavailable entirely until restart, the operational impact is effectively higher in practice. The absence of confidentiality/confidentiality impact (C:N/I:N) correctly reflects that this is not a data-exfiltration or integrity issue.

Detection Guidance

Sigma Rule

title: Hono parseBody Dot-Notation Resource Exhaustion Attempt
id: e4d4f0a1-2c4f-4e8e-9b2f-6a4c5d7e8f90
status: experimental
description: Detects HTTP requests with abnormally deep or numerous dot-separated form field names, indicating a potential resource exhaustion attempt against Hono parseBody dot-notation parsing.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-84364
author: Valtersit SOC
date: 2026/05/15
logsource:
    category: webserver
    product: generic
detection:
    selection_deep:
        http.request.body|contains|all:
            - '='
            - '.'
        http.request.body|re: '^[a-z](\.[a-z]){100,}'
    selection_breadth:
        http.request.body|contains|all:
            - '='
            - '&'
            - '.'
        http.request.body|re: '(^|[&])([a-z0-9_]+\.[a-z0-9_]+=){50,}'
    filter_default:
        http.request.body|contains: 'checksum'
    condition: selection_deep or selection_breadth
    timeout: 100ms
level: medium
falsepositives:
    - Legitimate nested form structures submitted to APIs that intentionally use dot-notation
    - Monitoring and health-check probes using deep dotted query parameters
fields:
    - src_ip
    - http.user_agent
    - http.request.method
    - http.request.body

YARA Rule

rule Hono_Dot_Notation_DoS_Payload
{
    meta:
        author = "Valtersit SOC"
        description = "Detects payload patterns likely used in CVE-2026-84364 resource exhaustion attacks"
        cve = "CVE-2026-84364"
        date = "2026-05-15"
        severity = "high"
        condition_note = "Requires HTTP body content scan (e.g., via Suricata file store or traffic capture)"
    strings:
        // Matches a deep dotted name: a.a.a.a.a...  (>= 100 dots)
        $deep = /[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+){100,}/
        // Matches many shallow dotted fields separated by &
        $many = /([a-zA-Z0-9_]+\.[a-zA-Z0-9_]+=.*&){50,}/
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Hono parseBody Dot-Notation DoS Attempt (CVE-2026-84364)";
    flow:to_server,established;
    content:"="; http_request_body;
    content:"."; http_request_body;
    pcre:"/[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+){100,}/Ri";
    classtype:attempted-dos;
    sid:2026084364;
    rev:1;
    reference:cve,2026-84364;
    metadata:created_at 2026-05-15;
)

Elastic Detection

configuration:
  - name: detect_deep_dotted_field
    query: |
      network where event.category == "network" and network.direction == "ingress"
      and http.request.body.content contains "=" and http.request.body.content contains "."
      and length(http.request.body.content) > 100
      // This EQL rule relies on an ingest pipeline extracting body; adjust mapping as needed.
      and http.request.body.content matches "[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+){100,}"

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| eval body_len = len(form_data)
| where body_len > 0 AND like(form_data, "%=") AND like(form_data, "%.")
| rex field=form_data max_match=0 "(?<dot_fields>[a-zA-Z0-9_]+\.[a-zA-Z0-9_]+)"
| eval dot_count = mvcount(dot_fields)
| eval depth_pattern = if(match(form_data, "[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+){100,}"), "deep", "shallow")
| where (depth_pattern == "deep") OR (dot_count > 50)
| stats count by src_ip, uri, depth_pattern, dot_count, body_len
| sort - count

Wazuh OSSEC Rule

<group name="web_application_dos,">
    <rule id="100643" level="10">
        <if_sid>31122</if_sid> <!-- Generic web server log rule -->
        <regex>\.([a-zA-Z0-9_]+\.){100,}</regex>
        <description>CVE-2026-84364: Hono parseBody dot-notation DoS attempt - deep nested field name detected in HTTP request.</description>
        <group>web_application,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
    <rule id="100644" level="8">
        <if_sid>31122</if_sid>
        <regex>([a-zA-Z0-9_]+\.[a-zA-Z0-9_]+=.*&){50,}</regex>
        <description>CVE-2026-84364: Hono parseBody dot-notation DoS attempt - high density of dotted form fields detected in HTTP request.</description>
        <group>web_application,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: 0/4 — UNPATCHED. No patch evidence from any tracked source was provided in the threat intelligence data. The NVD description states the issue is fixed in version 4.13.5, but no vendor advisory, commit hash, or patch confirmation has been received from CVE sources.

Immediate Mitigations:

1. Verify Configuration: Audit all running Hono applications to determine whether dot-notation parsing is enabled in parseBody(). If not enabled, no action is required — the default behavior is not affected.
2. Disable Dot-Notation Parsing: If the feature is enabled but not strictly required, disable it immediately. This eliminates the attack surface entirely.
3. Input-Layer Mitigation (if feature must remain enabled): Deploy a reverse proxy or WAF rule that rejects requests containing deeply nested dotted field names (e.g., more than 10 dot-separated segments) or more than a threshold of dotted fields per request (e.g., 100). Such a rule can be implemented at the load balancer or application gateway level.
4. Resource Isolation: Run affected Hono instances with memory limits (e.g., --max-old-space-size in Node.js) and implement automatic restart policies to minimize downtime in case of a crash.

Patch / Upgrade Steps:

1. Monitor the official Hono GitHub repository and release channels for version 4.13.5 or later.
2. Once the patched version is confirmed available, update all affected Hono instances: npm install hono@>=4.13.5 (or equivalent for the specific runtime).
3. After upgrading, re-run test cases that exercise parseBody() with dotted field names to verify that the fix enforces nesting depth and/or object-count limits as described in the NVD entry.

Long-Term Hardening:

1. Conduct a code review of all Hono route handlers to identify any reliance on parseBody() assuming default configuration.
2. Add a regression test in the CI/CD pipeline that sends malformed deeply nested form data and asserts the application remains responsive.
3. Implement regular version scanning for all third-party dependencies using a software composition analysis (SCA) tool that tracks Hono advisories.
4. For production deployments, consider enabling HTTP request body size limits at the reverse proxy level and implementing rate limiting per source IP to slow down concurrent exploitation attempts.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84364
• Hono Official GitHub Repository: https://github.com/honojs/hono (for version 4.13.5 release notes)
• Hono Documentation on Body Parsing: https://hono.dev/docs/helpers/parser (describes parseBody() options, including dot-notation flag)
• CWE-400 (Uncontrolled Resource Consumption): https://cwe.mitre.org/data/definitions/400.html

Campaign Intelligence: No threat actor campaigns, exploit-in-the-wild evidence, or public exploit code have been reported for CVE-2026-84364 as of the time of this report. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS scoring is not yet available from FIRST.org. The absence of proven in-the-wild exploitation does not diminish the risk, as the low attack complexity and minimal bandwidth requirement make this a straightforward candidate for botnet-driven DDoS campaigns once PoC materializes.