Hono versions prior to 4.12.7 have a prototype pollution vulnerability related to the parseBody({ dot: true }) feature. This feature allows dot notation in form field names to create nested objects, but does not filter the __proto__ key, enabling crafted input like __proto__.x to create objects with __proto__ properties. While Hono itself does not directly modify Object.prototype, unsafe merging of parsed results into other objects can lead to prototype pollution.