{"schema_version":"2","view":"grouped","data":[{"id":74257,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fpfm-992f-89v5","summary":"CGA-fpfm-992f-89v5","evidence":"osv:CGA-fpfm-992f-89v5","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fpfm-992f-89v5","aliases":["CGA-fpfm-992f-89v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fpfm-992f-89v5.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T21:28:45Z"}]}}],"modified":"2026-10-03T16:13:03.875381613Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bbb1595-2e8b-47af-bf51-47362420755d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fpfm-992f-89v5","advisory_id":"1bbb1595-2e8b-47af-bf51-47362420755d","event_types":["advisory"],"published_at":"2026-10-26T08:50:28.11364+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:37:50+00:00","detail_url":"/advisories/advisory%3A1bbb1595-2e8b-47af-bf51-47362420755d","group":{"id":"advisory:1bbb1595-2e8b-47af-bf51-47362420755d","revision":1,"primary_event_id":78558,"change":"published","superseded_by":[],"changed":{"id":78558,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fpfm-992f-89v5","summary":"CGA-fpfm-992f-89v5","evidence":"osv:CGA-fpfm-992f-89v5","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fpfm-992f-89v5","aliases":["CGA-fpfm-992f-89v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fpfm-992f-89v5.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T21:28:45Z"}]}}],"modified":"2026-10-03T16:13:03.875381613Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bbb1595-2e8b-47af-bf51-47362420755d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fpfm-992f-89v5","advisory_id":"1bbb1595-2e8b-47af-bf51-47362420755d","event_types":["advisory"],"published_at":"2026-10-26T08:50:28.11364+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:37:50+00:00","detail_url":"/events/78558"},"members":[{"id":78558,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fpfm-992f-89v5","summary":"CGA-fpfm-992f-89v5","evidence":"osv:CGA-fpfm-992f-89v5","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fpfm-992f-89v5","aliases":["CGA-fpfm-992f-89v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fpfm-992f-89v5.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T21:28:45Z"}]}}],"modified":"2026-10-03T16:13:03.875381613Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bbb1595-2e8b-47af-bf51-47362420755d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fpfm-992f-89v5","advisory_id":"1bbb1595-2e8b-47af-bf51-47362420755d","event_types":["advisory"],"published_at":"2026-10-26T08:50:28.11364+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:37:50+00:00","detail_url":"/events/78558"}]}},{"id":74256,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qxm4-238r-xg49","summary":"CGA-qxm4-238r-xg49","evidence":"osv:CGA-qxm4-238r-xg49","products":[{"name":{"value":"opensearch-dashboards-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qxm4-238r-xg49","aliases":["CGA-qxm4-238r-xg49"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r3"}]}],"package":{"name":"opensearch-dashboards-2","purl":"pkg:apk/chainguard/opensearch-dashboards-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qxm4-238r-xg49.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-27T21:55:25Z"}]}}],"modified":"2026-10-03T16:13:03.717488457Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:119110e5-4ac0-498e-afb0-85774cec1f36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qxm4-238r-xg49","advisory_id":"119110e5-4ac0-498e-afb0-85774cec1f36","event_types":["advisory"],"published_at":"2026-10-26T08:49:39.471425+00:00","technologies":["core-osv","opensearch-dashboards-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:36:13+00:00","detail_url":"/advisories/advisory%3A119110e5-4ac0-498e-afb0-85774cec1f36","group":{"id":"advisory:119110e5-4ac0-498e-afb0-85774cec1f36","revision":1,"primary_event_id":78549,"change":"published","superseded_by":[],"changed":{"id":78549,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qxm4-238r-xg49","summary":"CGA-qxm4-238r-xg49","evidence":"osv:CGA-qxm4-238r-xg49","products":[{"name":{"value":"opensearch-dashboards-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qxm4-238r-xg49","aliases":["CGA-qxm4-238r-xg49"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r3"}]}],"package":{"name":"opensearch-dashboards-2","purl":"pkg:apk/chainguard/opensearch-dashboards-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qxm4-238r-xg49.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-27T21:55:25Z"}]}}],"modified":"2026-10-03T16:13:03.717488457Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:119110e5-4ac0-498e-afb0-85774cec1f36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qxm4-238r-xg49","advisory_id":"119110e5-4ac0-498e-afb0-85774cec1f36","event_types":["advisory"],"published_at":"2026-10-26T08:49:39.471425+00:00","technologies":["core-osv","opensearch-dashboards-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:36:13+00:00","detail_url":"/events/78549"},"members":[{"id":78549,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qxm4-238r-xg49","summary":"CGA-qxm4-238r-xg49","evidence":"osv:CGA-qxm4-238r-xg49","products":[{"name":{"value":"opensearch-dashboards-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qxm4-238r-xg49","aliases":["CGA-qxm4-238r-xg49"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r3"}]}],"package":{"name":"opensearch-dashboards-2","purl":"pkg:apk/chainguard/opensearch-dashboards-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qxm4-238r-xg49.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-27T21:55:25Z"}]}}],"modified":"2026-10-03T16:13:03.717488457Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:119110e5-4ac0-498e-afb0-85774cec1f36","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qxm4-238r-xg49","advisory_id":"119110e5-4ac0-498e-afb0-85774cec1f36","event_types":["advisory"],"published_at":"2026-10-26T08:49:39.471425+00:00","technologies":["core-osv","opensearch-dashboards-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:36:13+00:00","detail_url":"/events/78549"}]}},{"id":74251,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-w9qr-pcx3-cxc8","summary":"CGA-w9qr-pcx3-cxc8","evidence":"osv:CGA-w9qr-pcx3-cxc8","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w9qr-pcx3-cxc8","aliases":["CGA-w9qr-pcx3-cxc8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w9qr-pcx3-cxc8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T05:41:13Z"}]}}],"modified":"2026-10-03T16:13:03.209908650Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24d6d440-f70d-46fb-8eb6-924f81ac59f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w9qr-pcx3-cxc8","advisory_id":"24d6d440-f70d-46fb-8eb6-924f81ac59f4","event_types":["advisory"],"published_at":"2026-10-26T08:26:28.131013+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:52:12+00:00","detail_url":"/advisories/advisory%3A24d6d440-f70d-46fb-8eb6-924f81ac59f4","group":{"id":"advisory:24d6d440-f70d-46fb-8eb6-924f81ac59f4","revision":1,"primary_event_id":78378,"change":"published","superseded_by":[],"changed":{"id":78378,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-w9qr-pcx3-cxc8","summary":"CGA-w9qr-pcx3-cxc8","evidence":"osv:CGA-w9qr-pcx3-cxc8","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w9qr-pcx3-cxc8","aliases":["CGA-w9qr-pcx3-cxc8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w9qr-pcx3-cxc8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T05:41:13Z"}]}}],"modified":"2026-10-03T16:13:03.209908650Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24d6d440-f70d-46fb-8eb6-924f81ac59f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w9qr-pcx3-cxc8","advisory_id":"24d6d440-f70d-46fb-8eb6-924f81ac59f4","event_types":["advisory"],"published_at":"2026-10-26T08:26:28.131013+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:52:12+00:00","detail_url":"/events/78378"},"members":[{"id":78378,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-w9qr-pcx3-cxc8","summary":"CGA-w9qr-pcx3-cxc8","evidence":"osv:CGA-w9qr-pcx3-cxc8","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w9qr-pcx3-cxc8","aliases":["CGA-w9qr-pcx3-cxc8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w9qr-pcx3-cxc8.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T05:41:13Z"}]}}],"modified":"2026-10-03T16:13:03.209908650Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:24d6d440-f70d-46fb-8eb6-924f81ac59f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w9qr-pcx3-cxc8","advisory_id":"24d6d440-f70d-46fb-8eb6-924f81ac59f4","event_types":["advisory"],"published_at":"2026-10-26T08:26:28.131013+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:52:12+00:00","detail_url":"/events/78378"}]}},{"id":74232,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-cq37-cggv-q6cw","summary":"CGA-cq37-cggv-q6cw","evidence":"osv:CGA-cq37-cggv-q6cw","products":[{"name":{"value":"kibana-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cq37-cggv-q6cw","aliases":["CGA-cq37-cggv-q6cw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3","purl":"pkg:apk/chainguard/kibana-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cq37-cggv-q6cw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:08:42Z"}]}}],"modified":"2026-10-03T16:13:01.621289717Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:203f220a-c0bb-4aa4-84d3-f82c2bec32e3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cq37-cggv-q6cw","advisory_id":"203f220a-c0bb-4aa4-84d3-f82c2bec32e3","event_types":["advisory"],"published_at":"2026-10-26T07:41:14.06724+00:00","technologies":["core-osv","kibana-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:48:59+00:00","detail_url":"/advisories/advisory%3A203f220a-c0bb-4aa4-84d3-f82c2bec32e3","group":{"id":"advisory:203f220a-c0bb-4aa4-84d3-f82c2bec32e3","revision":1,"primary_event_id":78035,"change":"published","superseded_by":[],"changed":{"id":78035,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-cq37-cggv-q6cw","summary":"CGA-cq37-cggv-q6cw","evidence":"osv:CGA-cq37-cggv-q6cw","products":[{"name":{"value":"kibana-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cq37-cggv-q6cw","aliases":["CGA-cq37-cggv-q6cw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3","purl":"pkg:apk/chainguard/kibana-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cq37-cggv-q6cw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:08:42Z"}]}}],"modified":"2026-10-03T16:13:01.621289717Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:203f220a-c0bb-4aa4-84d3-f82c2bec32e3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cq37-cggv-q6cw","advisory_id":"203f220a-c0bb-4aa4-84d3-f82c2bec32e3","event_types":["advisory"],"published_at":"2026-10-26T07:41:14.06724+00:00","technologies":["core-osv","kibana-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:48:59+00:00","detail_url":"/events/78035"},"members":[{"id":78035,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-cq37-cggv-q6cw","summary":"CGA-cq37-cggv-q6cw","evidence":"osv:CGA-cq37-cggv-q6cw","products":[{"name":{"value":"kibana-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cq37-cggv-q6cw","aliases":["CGA-cq37-cggv-q6cw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3","purl":"pkg:apk/chainguard/kibana-9.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cq37-cggv-q6cw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:08:42Z"}]}}],"modified":"2026-10-03T16:13:01.621289717Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:203f220a-c0bb-4aa4-84d3-f82c2bec32e3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cq37-cggv-q6cw","advisory_id":"203f220a-c0bb-4aa4-84d3-f82c2bec32e3","event_types":["advisory"],"published_at":"2026-10-26T07:41:14.06724+00:00","technologies":["core-osv","kibana-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:48:59+00:00","detail_url":"/events/78035"}]}},{"id":74212,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j5xv-7fq7-fm82","summary":"CGA-j5xv-7fq7-fm82","evidence":"osv:CGA-j5xv-7fq7-fm82","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j5xv-7fq7-fm82","aliases":["CGA-j5xv-7fq7-fm82"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j5xv-7fq7-fm82.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:50:07Z"}]}}],"modified":"2026-10-03T16:13:00.284880384Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j5xv-7fq7-fm82","advisory_id":"5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","event_types":["advisory"],"published_at":"2026-10-26T07:22:26.419213+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:49:38+00:00","detail_url":"/advisories/advisory%3A5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","group":{"id":"advisory:5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","revision":1,"primary_event_id":77809,"change":"published","superseded_by":[],"changed":{"id":77809,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j5xv-7fq7-fm82","summary":"CGA-j5xv-7fq7-fm82","evidence":"osv:CGA-j5xv-7fq7-fm82","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j5xv-7fq7-fm82","aliases":["CGA-j5xv-7fq7-fm82"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j5xv-7fq7-fm82.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:50:07Z"}]}}],"modified":"2026-10-03T16:13:00.284880384Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j5xv-7fq7-fm82","advisory_id":"5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","event_types":["advisory"],"published_at":"2026-10-26T07:22:26.419213+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:49:38+00:00","detail_url":"/events/77809"},"members":[{"id":77809,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j5xv-7fq7-fm82","summary":"CGA-j5xv-7fq7-fm82","evidence":"osv:CGA-j5xv-7fq7-fm82","products":[{"name":{"value":"hono-compat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j5xv-7fq7-fm82","aliases":["CGA-j5xv-7fq7-fm82"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-compat","purl":"pkg:apk/chainguard/hono-compat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j5xv-7fq7-fm82.json"},"ecosystem_specific":{"components":[{"component_name":"hono-compat","component_purl":"pkg:apk/hono-compat@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:50:07Z"}]}}],"modified":"2026-10-03T16:13:00.284880384Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j5xv-7fq7-fm82","advisory_id":"5ea72ae6-5ab7-4ddb-a802-f28fd2a26a14","event_types":["advisory"],"published_at":"2026-10-26T07:22:26.419213+00:00","technologies":["core-osv","hono-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:49:38+00:00","detail_url":"/events/77809"}]}},{"id":74198,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wc5f-r442-rwf8","summary":"CGA-wc5f-r442-rwf8","evidence":"osv:CGA-wc5f-r442-rwf8","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc5f-r442-rwf8","aliases":["CGA-wc5f-r442-rwf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc5f-r442-rwf8.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:11:11Z"}]}}],"modified":"2026-10-03T16:12:59.517191734Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c61069a3-57cf-42f0-be7a-01b5bbbbb95a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc5f-r442-rwf8","advisory_id":"c61069a3-57cf-42f0-be7a-01b5bbbbb95a","event_types":["advisory"],"published_at":"2026-10-26T07:06:19.318489+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:30:27+00:00","detail_url":"/advisories/advisory%3Ac61069a3-57cf-42f0-be7a-01b5bbbbb95a","group":{"id":"advisory:c61069a3-57cf-42f0-be7a-01b5bbbbb95a","revision":1,"primary_event_id":77647,"change":"published","superseded_by":[],"changed":{"id":77647,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wc5f-r442-rwf8","summary":"CGA-wc5f-r442-rwf8","evidence":"osv:CGA-wc5f-r442-rwf8","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc5f-r442-rwf8","aliases":["CGA-wc5f-r442-rwf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc5f-r442-rwf8.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:11:11Z"}]}}],"modified":"2026-10-03T16:12:59.517191734Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c61069a3-57cf-42f0-be7a-01b5bbbbb95a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc5f-r442-rwf8","advisory_id":"c61069a3-57cf-42f0-be7a-01b5bbbbb95a","event_types":["advisory"],"published_at":"2026-10-26T07:06:19.318489+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:30:27+00:00","detail_url":"/events/77647"},"members":[{"id":77647,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wc5f-r442-rwf8","summary":"CGA-wc5f-r442-rwf8","evidence":"osv:CGA-wc5f-r442-rwf8","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc5f-r442-rwf8","aliases":["CGA-wc5f-r442-rwf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc5f-r442-rwf8.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:11:11Z"}]}}],"modified":"2026-10-03T16:12:59.517191734Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c61069a3-57cf-42f0-be7a-01b5bbbbb95a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc5f-r442-rwf8","advisory_id":"c61069a3-57cf-42f0-be7a-01b5bbbbb95a","event_types":["advisory"],"published_at":"2026-10-26T07:06:19.318489+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:30:27+00:00","detail_url":"/events/77647"}]}},{"id":74191,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g8g4-8wmq-cj46","summary":"CGA-g8g4-8wmq-cj46","evidence":"osv:CGA-g8g4-8wmq-cj46","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8g4-8wmq-cj46","aliases":["CGA-g8g4-8wmq-cj46"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8g4-8wmq-cj46.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T23:19:24Z"}]}}],"modified":"2026-10-03T16:12:59.162955866Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ac4a995c-f044-4bc4-aebe-e18c7baf4a96","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8g4-8wmq-cj46","advisory_id":"ac4a995c-f044-4bc4-aebe-e18c7baf4a96","event_types":["advisory"],"published_at":"2026-10-26T06:54:05.785362+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:53:19+00:00","detail_url":"/advisories/advisory%3Aac4a995c-f044-4bc4-aebe-e18c7baf4a96","group":{"id":"advisory:ac4a995c-f044-4bc4-aebe-e18c7baf4a96","revision":1,"primary_event_id":77520,"change":"published","superseded_by":[],"changed":{"id":77520,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g8g4-8wmq-cj46","summary":"CGA-g8g4-8wmq-cj46","evidence":"osv:CGA-g8g4-8wmq-cj46","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8g4-8wmq-cj46","aliases":["CGA-g8g4-8wmq-cj46"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8g4-8wmq-cj46.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T23:19:24Z"}]}}],"modified":"2026-10-03T16:12:59.162955866Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ac4a995c-f044-4bc4-aebe-e18c7baf4a96","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8g4-8wmq-cj46","advisory_id":"ac4a995c-f044-4bc4-aebe-e18c7baf4a96","event_types":["advisory"],"published_at":"2026-10-26T06:54:05.785362+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:53:19+00:00","detail_url":"/events/77520"},"members":[{"id":77520,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g8g4-8wmq-cj46","summary":"CGA-g8g4-8wmq-cj46","evidence":"osv:CGA-g8g4-8wmq-cj46","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8g4-8wmq-cj46","aliases":["CGA-g8g4-8wmq-cj46"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8g4-8wmq-cj46.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T23:19:24Z"}]}}],"modified":"2026-10-03T16:12:59.162955866Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ac4a995c-f044-4bc4-aebe-e18c7baf4a96","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8g4-8wmq-cj46","advisory_id":"ac4a995c-f044-4bc4-aebe-e18c7baf4a96","event_types":["advisory"],"published_at":"2026-10-26T06:54:05.785362+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:53:19+00:00","detail_url":"/events/77520"}]}},{"id":74182,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35j4-3mpj-c2qq","summary":"CGA-35j4-3mpj-c2qq","evidence":"osv:CGA-35j4-3mpj-c2qq","products":[{"name":{"value":"kibana-9.3-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35j4-3mpj-c2qq","aliases":["CGA-35j4-3mpj-c2qq"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3-iamguarded","purl":"pkg:apk/chainguard/kibana-9.3-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35j4-3mpj-c2qq.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:46:10Z"}]}}],"modified":"2026-10-03T16:12:58.668471533Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7a5a61f4-00c5-4812-8f48-03952444eb61","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35j4-3mpj-c2qq","advisory_id":"7a5a61f4-00c5-4812-8f48-03952444eb61","event_types":["advisory"],"published_at":"2026-10-26T06:44:47.126551+00:00","technologies":["core-osv","kibana-9-3-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:37:37+00:00","detail_url":"/advisories/advisory%3A7a5a61f4-00c5-4812-8f48-03952444eb61","group":{"id":"advisory:7a5a61f4-00c5-4812-8f48-03952444eb61","revision":1,"primary_event_id":77431,"change":"published","superseded_by":[],"changed":{"id":77431,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35j4-3mpj-c2qq","summary":"CGA-35j4-3mpj-c2qq","evidence":"osv:CGA-35j4-3mpj-c2qq","products":[{"name":{"value":"kibana-9.3-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35j4-3mpj-c2qq","aliases":["CGA-35j4-3mpj-c2qq"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3-iamguarded","purl":"pkg:apk/chainguard/kibana-9.3-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35j4-3mpj-c2qq.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:46:10Z"}]}}],"modified":"2026-10-03T16:12:58.668471533Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7a5a61f4-00c5-4812-8f48-03952444eb61","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35j4-3mpj-c2qq","advisory_id":"7a5a61f4-00c5-4812-8f48-03952444eb61","event_types":["advisory"],"published_at":"2026-10-26T06:44:47.126551+00:00","technologies":["core-osv","kibana-9-3-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:37:37+00:00","detail_url":"/events/77431"},"members":[{"id":77431,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35j4-3mpj-c2qq","summary":"CGA-35j4-3mpj-c2qq","evidence":"osv:CGA-35j4-3mpj-c2qq","products":[{"name":{"value":"kibana-9.3-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.3.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35j4-3mpj-c2qq","aliases":["CGA-35j4-3mpj-c2qq"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1-r1"}]}],"package":{"name":"kibana-9.3-iamguarded","purl":"pkg:apk/chainguard/kibana-9.3-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35j4-3mpj-c2qq.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T21:46:10Z"}]}}],"modified":"2026-10-03T16:12:58.668471533Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7a5a61f4-00c5-4812-8f48-03952444eb61","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35j4-3mpj-c2qq","advisory_id":"7a5a61f4-00c5-4812-8f48-03952444eb61","event_types":["advisory"],"published_at":"2026-10-26T06:44:47.126551+00:00","technologies":["core-osv","kibana-9-3-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:37:37+00:00","detail_url":"/events/77431"}]}},{"id":74176,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-4hrg-7qgg-w66j","summary":"CGA-4hrg-7qgg-w66j","evidence":"osv:CGA-4hrg-7qgg-w66j","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4hrg-7qgg-w66j","aliases":["CGA-4hrg-7qgg-w66j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hrg-7qgg-w66j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:28:00Z"}]}}],"modified":"2026-10-03T16:12:58.187102051Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450b8231-4574-47b9-9b67-d208e4071433","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hrg-7qgg-w66j","advisory_id":"450b8231-4574-47b9-9b67-d208e4071433","event_types":["advisory"],"published_at":"2026-10-26T06:39:05.355494+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:51:06+00:00","detail_url":"/advisories/advisory%3A450b8231-4574-47b9-9b67-d208e4071433","group":{"id":"advisory:450b8231-4574-47b9-9b67-d208e4071433","revision":1,"primary_event_id":77363,"change":"published","superseded_by":[],"changed":{"id":77363,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-4hrg-7qgg-w66j","summary":"CGA-4hrg-7qgg-w66j","evidence":"osv:CGA-4hrg-7qgg-w66j","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4hrg-7qgg-w66j","aliases":["CGA-4hrg-7qgg-w66j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hrg-7qgg-w66j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:28:00Z"}]}}],"modified":"2026-10-03T16:12:58.187102051Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450b8231-4574-47b9-9b67-d208e4071433","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hrg-7qgg-w66j","advisory_id":"450b8231-4574-47b9-9b67-d208e4071433","event_types":["advisory"],"published_at":"2026-10-26T06:39:05.355494+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:51:06+00:00","detail_url":"/events/77363"},"members":[{"id":77363,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-4hrg-7qgg-w66j","summary":"CGA-4hrg-7qgg-w66j","evidence":"osv:CGA-4hrg-7qgg-w66j","products":[{"name":{"value":"hono-service-command-router","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4hrg-7qgg-w66j","aliases":["CGA-4hrg-7qgg-w66j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-command-router","purl":"pkg:apk/chainguard/hono-service-command-router?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4hrg-7qgg-w66j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-command-router","component_purl":"pkg:apk/hono-service-command-router@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:28:00Z"}]}}],"modified":"2026-10-03T16:12:58.187102051Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450b8231-4574-47b9-9b67-d208e4071433","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4hrg-7qgg-w66j","advisory_id":"450b8231-4574-47b9-9b67-d208e4071433","event_types":["advisory"],"published_at":"2026-10-26T06:39:05.355494+00:00","technologies":["core-osv","hono-service-command-router"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:51:06+00:00","detail_url":"/events/77363"}]}},{"id":74164,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5829-v434-2w6m","summary":"CGA-5829-v434-2w6m","evidence":"osv:CGA-5829-v434-2w6m","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5829-v434-2w6m","aliases":["CGA-5829-v434-2w6m"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5829-v434-2w6m.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T09:01:09Z"}]}}],"modified":"2026-10-03T16:12:57.365934868Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f0ca7e6-2162-469f-86ab-e7a85d0044a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5829-v434-2w6m","advisory_id":"0f0ca7e6-2162-469f-86ab-e7a85d0044a4","event_types":["advisory"],"published_at":"2026-10-26T06:25:59.511294+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:50:59+00:00","detail_url":"/advisories/advisory%3A0f0ca7e6-2162-469f-86ab-e7a85d0044a4","group":{"id":"advisory:0f0ca7e6-2162-469f-86ab-e7a85d0044a4","revision":1,"primary_event_id":77233,"change":"published","superseded_by":[],"changed":{"id":77233,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5829-v434-2w6m","summary":"CGA-5829-v434-2w6m","evidence":"osv:CGA-5829-v434-2w6m","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5829-v434-2w6m","aliases":["CGA-5829-v434-2w6m"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5829-v434-2w6m.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T09:01:09Z"}]}}],"modified":"2026-10-03T16:12:57.365934868Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f0ca7e6-2162-469f-86ab-e7a85d0044a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5829-v434-2w6m","advisory_id":"0f0ca7e6-2162-469f-86ab-e7a85d0044a4","event_types":["advisory"],"published_at":"2026-10-26T06:25:59.511294+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:50:59+00:00","detail_url":"/events/77233"},"members":[{"id":77233,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5829-v434-2w6m","summary":"CGA-5829-v434-2w6m","evidence":"osv:CGA-5829-v434-2w6m","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5829-v434-2w6m","aliases":["CGA-5829-v434-2w6m"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5829-v434-2w6m.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T09:01:09Z"}]}}],"modified":"2026-10-03T16:12:57.365934868Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0f0ca7e6-2162-469f-86ab-e7a85d0044a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5829-v434-2w6m","advisory_id":"0f0ca7e6-2162-469f-86ab-e7a85d0044a4","event_types":["advisory"],"published_at":"2026-10-26T06:25:59.511294+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:50:59+00:00","detail_url":"/events/77233"}]}},{"id":74132,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rxff-cj86-72f7","summary":"CGA-rxff-cj86-72f7","evidence":"osv:CGA-rxff-cj86-72f7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rxff-cj86-72f7","aliases":["CGA-rxff-cj86-72f7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rxff-cj86-72f7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:33:10Z"}]}}],"modified":"2026-10-03T16:12:55.091193514Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c47faf53-e944-4882-82e3-afc81fc55aba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rxff-cj86-72f7","advisory_id":"c47faf53-e944-4882-82e3-afc81fc55aba","event_types":["advisory"],"published_at":"2026-10-26T05:41:48.378715+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:50:07+00:00","detail_url":"/advisories/advisory%3Ac47faf53-e944-4882-82e3-afc81fc55aba","group":{"id":"advisory:c47faf53-e944-4882-82e3-afc81fc55aba","revision":1,"primary_event_id":76810,"change":"published","superseded_by":[],"changed":{"id":76810,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rxff-cj86-72f7","summary":"CGA-rxff-cj86-72f7","evidence":"osv:CGA-rxff-cj86-72f7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rxff-cj86-72f7","aliases":["CGA-rxff-cj86-72f7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rxff-cj86-72f7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:33:10Z"}]}}],"modified":"2026-10-03T16:12:55.091193514Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c47faf53-e944-4882-82e3-afc81fc55aba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rxff-cj86-72f7","advisory_id":"c47faf53-e944-4882-82e3-afc81fc55aba","event_types":["advisory"],"published_at":"2026-10-26T05:41:48.378715+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:50:07+00:00","detail_url":"/events/76810"},"members":[{"id":76810,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rxff-cj86-72f7","summary":"CGA-rxff-cj86-72f7","evidence":"osv:CGA-rxff-cj86-72f7","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rxff-cj86-72f7","aliases":["CGA-rxff-cj86-72f7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rxff-cj86-72f7.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T07:33:10Z"}]}}],"modified":"2026-10-03T16:12:55.091193514Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c47faf53-e944-4882-82e3-afc81fc55aba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rxff-cj86-72f7","advisory_id":"c47faf53-e944-4882-82e3-afc81fc55aba","event_types":["advisory"],"published_at":"2026-10-26T05:41:48.378715+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T03:50:07+00:00","detail_url":"/events/76810"}]}},{"id":74059,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r63j-j8j2-mw3r","summary":"CGA-r63j-j8j2-mw3r","evidence":"osv:CGA-r63j-j8j2-mw3r","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r63j-j8j2-mw3r","aliases":["CGA-r63j-j8j2-mw3r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r63j-j8j2-mw3r.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T21:10:26Z"}]}}],"modified":"2026-10-03T16:12:52.301952224Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25cfb24e-0c5f-418d-a0be-31f7dbcf85da","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r63j-j8j2-mw3r","advisory_id":"25cfb24e-0c5f-418d-a0be-31f7dbcf85da","event_types":["advisory"],"published_at":"2026-10-26T05:20:32.091731+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:26:05+00:00","detail_url":"/advisories/advisory%3A25cfb24e-0c5f-418d-a0be-31f7dbcf85da","group":{"id":"advisory:25cfb24e-0c5f-418d-a0be-31f7dbcf85da","revision":1,"primary_event_id":76586,"change":"published","superseded_by":[],"changed":{"id":76586,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r63j-j8j2-mw3r","summary":"CGA-r63j-j8j2-mw3r","evidence":"osv:CGA-r63j-j8j2-mw3r","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r63j-j8j2-mw3r","aliases":["CGA-r63j-j8j2-mw3r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r63j-j8j2-mw3r.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T21:10:26Z"}]}}],"modified":"2026-10-03T16:12:52.301952224Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25cfb24e-0c5f-418d-a0be-31f7dbcf85da","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r63j-j8j2-mw3r","advisory_id":"25cfb24e-0c5f-418d-a0be-31f7dbcf85da","event_types":["advisory"],"published_at":"2026-10-26T05:20:32.091731+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:26:05+00:00","detail_url":"/events/76586"},"members":[{"id":76586,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r63j-j8j2-mw3r","summary":"CGA-r63j-j8j2-mw3r","evidence":"osv:CGA-r63j-j8j2-mw3r","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r63j-j8j2-mw3r","aliases":["CGA-r63j-j8j2-mw3r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-r3"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r63j-j8j2-mw3r.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.11.10","component_type":"npm","component_version":"4.11.10","component_location":"/app/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-04-16T21:10:26Z"}]}}],"modified":"2026-10-03T16:12:52.301952224Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25cfb24e-0c5f-418d-a0be-31f7dbcf85da","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r63j-j8j2-mw3r","advisory_id":"25cfb24e-0c5f-418d-a0be-31f7dbcf85da","event_types":["advisory"],"published_at":"2026-10-26T05:20:32.091731+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T23:26:05+00:00","detail_url":"/events/76586"}]}},{"id":74037,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35vh-jqc6-654c","summary":"CGA-35vh-jqc6-654c","evidence":"osv:CGA-35vh-jqc6-654c","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35vh-jqc6-654c","aliases":["CGA-35vh-jqc6-654c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35vh-jqc6-654c.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:05:11Z"}]}}],"modified":"2026-10-03T16:12:51.487863594Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3118b878-a03b-41f1-8178-bfe20c8c8e0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35vh-jqc6-654c","advisory_id":"3118b878-a03b-41f1-8178-bfe20c8c8e0f","event_types":["advisory"],"published_at":"2026-10-26T05:16:28.189924+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:06:03+00:00","detail_url":"/advisories/advisory%3A3118b878-a03b-41f1-8178-bfe20c8c8e0f","group":{"id":"advisory:3118b878-a03b-41f1-8178-bfe20c8c8e0f","revision":1,"primary_event_id":76529,"change":"published","superseded_by":[],"changed":{"id":76529,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35vh-jqc6-654c","summary":"CGA-35vh-jqc6-654c","evidence":"osv:CGA-35vh-jqc6-654c","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35vh-jqc6-654c","aliases":["CGA-35vh-jqc6-654c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35vh-jqc6-654c.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:05:11Z"}]}}],"modified":"2026-10-03T16:12:51.487863594Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3118b878-a03b-41f1-8178-bfe20c8c8e0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35vh-jqc6-654c","advisory_id":"3118b878-a03b-41f1-8178-bfe20c8c8e0f","event_types":["advisory"],"published_at":"2026-10-26T05:16:28.189924+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:06:03+00:00","detail_url":"/events/76529"},"members":[{"id":76529,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-35vh-jqc6-654c","summary":"CGA-35vh-jqc6-654c","evidence":"osv:CGA-35vh-jqc6-654c","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-35vh-jqc6-654c","aliases":["CGA-35vh-jqc6-654c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-35vh-jqc6-654c.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:05:11Z"}]}}],"modified":"2026-10-03T16:12:51.487863594Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3118b878-a03b-41f1-8178-bfe20c8c8e0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-35vh-jqc6-654c","advisory_id":"3118b878-a03b-41f1-8178-bfe20c8c8e0f","event_types":["advisory"],"published_at":"2026-10-26T05:16:28.189924+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:06:03+00:00","detail_url":"/events/76529"}]}},{"id":73936,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-x33x-76jg-2r48","summary":"CGA-x33x-76jg-2r48","evidence":"osv:CGA-x33x-76jg-2r48","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x33x-76jg-2r48","aliases":["CGA-x33x-76jg-2r48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x33x-76jg-2r48.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:49:53Z"}]}}],"modified":"2026-10-03T16:12:49.171062259Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3a2973b-a208-46cf-bdc0-e7270baa4bc1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x33x-76jg-2r48","advisory_id":"a3a2973b-a208-46cf-bdc0-e7270baa4bc1","event_types":["advisory"],"published_at":"2026-10-26T05:02:48.162583+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:41:02+00:00","detail_url":"/advisories/advisory%3Aa3a2973b-a208-46cf-bdc0-e7270baa4bc1","group":{"id":"advisory:a3a2973b-a208-46cf-bdc0-e7270baa4bc1","revision":1,"primary_event_id":76377,"change":"published","superseded_by":[],"changed":{"id":76377,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-x33x-76jg-2r48","summary":"CGA-x33x-76jg-2r48","evidence":"osv:CGA-x33x-76jg-2r48","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x33x-76jg-2r48","aliases":["CGA-x33x-76jg-2r48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x33x-76jg-2r48.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:49:53Z"}]}}],"modified":"2026-10-03T16:12:49.171062259Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3a2973b-a208-46cf-bdc0-e7270baa4bc1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x33x-76jg-2r48","advisory_id":"a3a2973b-a208-46cf-bdc0-e7270baa4bc1","event_types":["advisory"],"published_at":"2026-10-26T05:02:48.162583+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:41:02+00:00","detail_url":"/events/76377"},"members":[{"id":76377,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-x33x-76jg-2r48","summary":"CGA-x33x-76jg-2r48","evidence":"osv:CGA-x33x-76jg-2r48","products":[{"name":{"value":"hono-service-device-registry-jdbc","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x33x-76jg-2r48","aliases":["CGA-x33x-76jg-2r48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-device-registry-jdbc","purl":"pkg:apk/chainguard/hono-service-device-registry-jdbc?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x33x-76jg-2r48.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-device-registry-jdbc","component_purl":"pkg:apk/hono-service-device-registry-jdbc@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-29T01:49:53Z"}]}}],"modified":"2026-10-03T16:12:49.171062259Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3a2973b-a208-46cf-bdc0-e7270baa4bc1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x33x-76jg-2r48","advisory_id":"a3a2973b-a208-46cf-bdc0-e7270baa4bc1","event_types":["advisory"],"published_at":"2026-10-26T05:02:48.162583+00:00","technologies":["core-osv","hono-service-device-registry-jdbc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:41:02+00:00","detail_url":"/events/76377"}]}},{"id":73863,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-2956-xqwv-cw6v","summary":"CGA-2956-xqwv-cw6v","evidence":"osv:CGA-2956-xqwv-cw6v","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2956-xqwv-cw6v","aliases":["CGA-2956-xqwv-cw6v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}}],"modified":"2026-10-03T16:12:47.705238469Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5339e5fa-ab56-4c5c-98e7-f086f487d23e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2956-xqwv-cw6v","advisory_id":"5339e5fa-ab56-4c5c-98e7-f086f487d23e","event_types":["advisory"],"published_at":"2026-10-26T04:52:28.575974+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:57:31+00:00","detail_url":"/advisories/advisory%3A5339e5fa-ab56-4c5c-98e7-f086f487d23e","group":{"id":"advisory:5339e5fa-ab56-4c5c-98e7-f086f487d23e","revision":1,"primary_event_id":76294,"change":"published","superseded_by":[],"changed":{"id":76294,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-2956-xqwv-cw6v","summary":"CGA-2956-xqwv-cw6v","evidence":"osv:CGA-2956-xqwv-cw6v","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2956-xqwv-cw6v","aliases":["CGA-2956-xqwv-cw6v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}}],"modified":"2026-10-03T16:12:47.705238469Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5339e5fa-ab56-4c5c-98e7-f086f487d23e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2956-xqwv-cw6v","advisory_id":"5339e5fa-ab56-4c5c-98e7-f086f487d23e","event_types":["advisory"],"published_at":"2026-10-26T04:52:28.575974+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:57:31+00:00","detail_url":"/events/76294"},"members":[{"id":76294,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-2956-xqwv-cw6v","summary":"CGA-2956-xqwv-cw6v","evidence":"osv:CGA-2956-xqwv-cw6v","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2956-xqwv-cw6v","aliases":["CGA-2956-xqwv-cw6v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2956-xqwv-cw6v.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T11:22:00Z"}]}}],"modified":"2026-10-03T16:12:47.705238469Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5339e5fa-ab56-4c5c-98e7-f086f487d23e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2956-xqwv-cw6v","advisory_id":"5339e5fa-ab56-4c5c-98e7-f086f487d23e","event_types":["advisory"],"published_at":"2026-10-26T04:52:28.575974+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:57:31+00:00","detail_url":"/events/76294"}]}},{"id":73785,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r678-78qg-6v6x","summary":"CGA-r678-78qg-6v6x","evidence":"osv:CGA-r678-78qg-6v6x","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r678-78qg-6v6x","aliases":["CGA-r678-78qg-6v6x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r678-78qg-6v6x.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:28:41Z"}]}}],"modified":"2026-10-03T16:12:46.094069984Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r678-78qg-6v6x","advisory_id":"ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","event_types":["advisory"],"published_at":"2026-10-26T04:47:20.835844+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:52:51+00:00","detail_url":"/advisories/advisory%3Aecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","group":{"id":"advisory:ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","revision":1,"primary_event_id":76209,"change":"published","superseded_by":[],"changed":{"id":76209,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r678-78qg-6v6x","summary":"CGA-r678-78qg-6v6x","evidence":"osv:CGA-r678-78qg-6v6x","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r678-78qg-6v6x","aliases":["CGA-r678-78qg-6v6x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r678-78qg-6v6x.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:28:41Z"}]}}],"modified":"2026-10-03T16:12:46.094069984Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r678-78qg-6v6x","advisory_id":"ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","event_types":["advisory"],"published_at":"2026-10-26T04:47:20.835844+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:52:51+00:00","detail_url":"/events/76209"},"members":[{"id":76209,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-r678-78qg-6v6x","summary":"CGA-r678-78qg-6v6x","evidence":"osv:CGA-r678-78qg-6v6x","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r678-78qg-6v6x","aliases":["CGA-r678-78qg-6v6x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r678-78qg-6v6x.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:28:41Z"}]}}],"modified":"2026-10-03T16:12:46.094069984Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r678-78qg-6v6x","advisory_id":"ecae2ff3-a65e-4cab-9e08-8dd5b9522d3d","event_types":["advisory"],"published_at":"2026-10-26T04:47:20.835844+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:52:51+00:00","detail_url":"/events/76209"}]}},{"id":73711,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g6j6-cfx9-m3fw","summary":"CGA-g6j6-cfx9-m3fw","evidence":"osv:CGA-g6j6-cfx9-m3fw","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g6j6-cfx9-m3fw","aliases":["CGA-g6j6-cfx9-m3fw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g6j6-cfx9-m3fw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:13:18Z"}]}}],"modified":"2026-10-03T16:12:44.664963277Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8f9b4326-37d5-4fd7-a786-c6f456cf559b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g6j6-cfx9-m3fw","advisory_id":"8f9b4326-37d5-4fd7-a786-c6f456cf559b","event_types":["advisory"],"published_at":"2026-10-26T04:41:57.836158+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:00:28+00:00","detail_url":"/advisories/advisory%3A8f9b4326-37d5-4fd7-a786-c6f456cf559b","group":{"id":"advisory:8f9b4326-37d5-4fd7-a786-c6f456cf559b","revision":1,"primary_event_id":76121,"change":"published","superseded_by":[],"changed":{"id":76121,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g6j6-cfx9-m3fw","summary":"CGA-g6j6-cfx9-m3fw","evidence":"osv:CGA-g6j6-cfx9-m3fw","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g6j6-cfx9-m3fw","aliases":["CGA-g6j6-cfx9-m3fw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g6j6-cfx9-m3fw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:13:18Z"}]}}],"modified":"2026-10-03T16:12:44.664963277Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8f9b4326-37d5-4fd7-a786-c6f456cf559b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g6j6-cfx9-m3fw","advisory_id":"8f9b4326-37d5-4fd7-a786-c6f456cf559b","event_types":["advisory"],"published_at":"2026-10-26T04:41:57.836158+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:00:28+00:00","detail_url":"/events/76121"},"members":[{"id":76121,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-g6j6-cfx9-m3fw","summary":"CGA-g6j6-cfx9-m3fw","evidence":"osv:CGA-g6j6-cfx9-m3fw","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g6j6-cfx9-m3fw","aliases":["CGA-g6j6-cfx9-m3fw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g6j6-cfx9-m3fw.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:13:18Z"}]}}],"modified":"2026-10-03T16:12:44.664963277Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8f9b4326-37d5-4fd7-a786-c6f456cf559b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g6j6-cfx9-m3fw","advisory_id":"8f9b4326-37d5-4fd7-a786-c6f456cf559b","event_types":["advisory"],"published_at":"2026-10-26T04:41:57.836158+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:00:28+00:00","detail_url":"/events/76121"}]}},{"id":73694,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wvhg-g25v-6mr4","summary":"CGA-wvhg-g25v-6mr4","evidence":"osv:CGA-wvhg-g25v-6mr4","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wvhg-g25v-6mr4","aliases":["CGA-wvhg-g25v-6mr4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wvhg-g25v-6mr4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:52:00Z"}]}}],"modified":"2026-10-03T16:12:44.281820201Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wvhg-g25v-6mr4","advisory_id":"7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","event_types":["advisory"],"published_at":"2026-10-26T04:41:14.239774+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:19:48+00:00","detail_url":"/advisories/advisory%3A7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","group":{"id":"advisory:7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","revision":1,"primary_event_id":76104,"change":"published","superseded_by":[],"changed":{"id":76104,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wvhg-g25v-6mr4","summary":"CGA-wvhg-g25v-6mr4","evidence":"osv:CGA-wvhg-g25v-6mr4","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wvhg-g25v-6mr4","aliases":["CGA-wvhg-g25v-6mr4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wvhg-g25v-6mr4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:52:00Z"}]}}],"modified":"2026-10-03T16:12:44.281820201Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wvhg-g25v-6mr4","advisory_id":"7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","event_types":["advisory"],"published_at":"2026-10-26T04:41:14.239774+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:19:48+00:00","detail_url":"/events/76104"},"members":[{"id":76104,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-wvhg-g25v-6mr4","summary":"CGA-wvhg-g25v-6mr4","evidence":"osv:CGA-wvhg-g25v-6mr4","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wvhg-g25v-6mr4","aliases":["CGA-wvhg-g25v-6mr4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wvhg-g25v-6mr4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:52:00Z"}]}}],"modified":"2026-10-03T16:12:44.281820201Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wvhg-g25v-6mr4","advisory_id":"7f270c8b-fa78-4df2-9f0c-e26d2f5bbd01","event_types":["advisory"],"published_at":"2026-10-26T04:41:14.239774+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:19:48+00:00","detail_url":"/events/76104"}]}},{"id":73668,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qh58-wg29-2jf4","summary":"CGA-qh58-wg29-2jf4","evidence":"osv:CGA-qh58-wg29-2jf4","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh58-wg29-2jf4","aliases":["CGA-qh58-wg29-2jf4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh58-wg29-2jf4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:46:10Z"}]}}],"modified":"2026-10-03T16:12:43.765927602Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:884d4dfa-ede7-4739-b59b-23886a4ce352","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh58-wg29-2jf4","advisory_id":"884d4dfa-ede7-4739-b59b-23886a4ce352","event_types":["advisory"],"published_at":"2026-10-26T04:40:18.754804+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:07:25+00:00","detail_url":"/advisories/advisory%3A884d4dfa-ede7-4739-b59b-23886a4ce352","group":{"id":"advisory:884d4dfa-ede7-4739-b59b-23886a4ce352","revision":1,"primary_event_id":76078,"change":"published","superseded_by":[],"changed":{"id":76078,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qh58-wg29-2jf4","summary":"CGA-qh58-wg29-2jf4","evidence":"osv:CGA-qh58-wg29-2jf4","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh58-wg29-2jf4","aliases":["CGA-qh58-wg29-2jf4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh58-wg29-2jf4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:46:10Z"}]}}],"modified":"2026-10-03T16:12:43.765927602Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:884d4dfa-ede7-4739-b59b-23886a4ce352","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh58-wg29-2jf4","advisory_id":"884d4dfa-ede7-4739-b59b-23886a4ce352","event_types":["advisory"],"published_at":"2026-10-26T04:40:18.754804+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:07:25+00:00","detail_url":"/events/76078"},"members":[{"id":76078,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-qh58-wg29-2jf4","summary":"CGA-qh58-wg29-2jf4","evidence":"osv:CGA-qh58-wg29-2jf4","products":[{"name":{"value":"kibana-9.2-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qh58-wg29-2jf4","aliases":["CGA-qh58-wg29-2jf4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2-iamguarded","purl":"pkg:apk/chainguard/kibana-9.2-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qh58-wg29-2jf4.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T17:46:10Z"}]}}],"modified":"2026-10-03T16:12:43.765927602Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:884d4dfa-ede7-4739-b59b-23886a4ce352","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qh58-wg29-2jf4","advisory_id":"884d4dfa-ede7-4739-b59b-23886a4ce352","event_types":["advisory"],"published_at":"2026-10-26T04:40:18.754804+00:00","technologies":["core-osv","kibana-9-2-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:07:25+00:00","detail_url":"/events/76078"}]}},{"id":73659,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rffp-qp6c-hqc4","summary":"CGA-rffp-qp6c-hqc4","evidence":"osv:CGA-rffp-qp6c-hqc4","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rffp-qp6c-hqc4","aliases":["CGA-rffp-qp6c-hqc4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rffp-qp6c-hqc4.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:05:31Z"}]}}],"modified":"2026-10-03T16:12:43.534898847Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8ff084cc-a0bf-4a69-92d0-9ead08e7e219","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rffp-qp6c-hqc4","advisory_id":"8ff084cc-a0bf-4a69-92d0-9ead08e7e219","event_types":["advisory"],"published_at":"2026-10-26T04:40:06.817643+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:05:46+00:00","detail_url":"/advisories/advisory%3A8ff084cc-a0bf-4a69-92d0-9ead08e7e219","group":{"id":"advisory:8ff084cc-a0bf-4a69-92d0-9ead08e7e219","revision":1,"primary_event_id":76069,"change":"published","superseded_by":[],"changed":{"id":76069,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rffp-qp6c-hqc4","summary":"CGA-rffp-qp6c-hqc4","evidence":"osv:CGA-rffp-qp6c-hqc4","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rffp-qp6c-hqc4","aliases":["CGA-rffp-qp6c-hqc4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rffp-qp6c-hqc4.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:05:31Z"}]}}],"modified":"2026-10-03T16:12:43.534898847Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8ff084cc-a0bf-4a69-92d0-9ead08e7e219","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rffp-qp6c-hqc4","advisory_id":"8ff084cc-a0bf-4a69-92d0-9ead08e7e219","event_types":["advisory"],"published_at":"2026-10-26T04:40:06.817643+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:05:46+00:00","detail_url":"/events/76069"},"members":[{"id":76069,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-rffp-qp6c-hqc4","summary":"CGA-rffp-qp6c-hqc4","evidence":"osv:CGA-rffp-qp6c-hqc4","products":[{"name":{"value":"hono-cli","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rffp-qp6c-hqc4","aliases":["CGA-rffp-qp6c-hqc4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-cli","purl":"pkg:apk/chainguard/hono-cli?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rffp-qp6c-hqc4.json"},"ecosystem_specific":{"components":[{"component_name":"hono-cli","component_purl":"pkg:apk/hono-cli@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:05:31Z"}]}}],"modified":"2026-10-03T16:12:43.534898847Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8ff084cc-a0bf-4a69-92d0-9ead08e7e219","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rffp-qp6c-hqc4","advisory_id":"8ff084cc-a0bf-4a69-92d0-9ead08e7e219","event_types":["advisory"],"published_at":"2026-10-26T04:40:06.817643+00:00","technologies":["core-osv","hono-cli"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:05:46+00:00","detail_url":"/events/76069"}]}},{"id":73622,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5ph3-pf5p-vprv","summary":"CGA-5ph3-pf5p-vprv","evidence":"osv:CGA-5ph3-pf5p-vprv","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5ph3-pf5p-vprv","aliases":["CGA-5ph3-pf5p-vprv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5ph3-pf5p-vprv.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T10:45:10Z"}]}}],"modified":"2026-10-03T16:12:42.817124805Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:38467a80-92a2-453f-8a3f-0ee8b7370d5e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5ph3-pf5p-vprv","advisory_id":"38467a80-92a2-453f-8a3f-0ee8b7370d5e","event_types":["advisory"],"published_at":"2026-10-26T04:38:27.546479+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:01:20+00:00","detail_url":"/advisories/advisory%3A38467a80-92a2-453f-8a3f-0ee8b7370d5e","group":{"id":"advisory:38467a80-92a2-453f-8a3f-0ee8b7370d5e","revision":1,"primary_event_id":76028,"change":"published","superseded_by":[],"changed":{"id":76028,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5ph3-pf5p-vprv","summary":"CGA-5ph3-pf5p-vprv","evidence":"osv:CGA-5ph3-pf5p-vprv","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5ph3-pf5p-vprv","aliases":["CGA-5ph3-pf5p-vprv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5ph3-pf5p-vprv.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T10:45:10Z"}]}}],"modified":"2026-10-03T16:12:42.817124805Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:38467a80-92a2-453f-8a3f-0ee8b7370d5e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5ph3-pf5p-vprv","advisory_id":"38467a80-92a2-453f-8a3f-0ee8b7370d5e","event_types":["advisory"],"published_at":"2026-10-26T04:38:27.546479+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:01:20+00:00","detail_url":"/events/76028"},"members":[{"id":76028,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5ph3-pf5p-vprv","summary":"CGA-5ph3-pf5p-vprv","evidence":"osv:CGA-5ph3-pf5p-vprv","products":[{"name":{"value":"opensearch-dashboards-2-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.5-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5ph3-pf5p-vprv","aliases":["CGA-5ph3-pf5p-vprv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r1"}]}],"package":{"name":"opensearch-dashboards-2-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5ph3-pf5p-vprv.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/opensearch-dashboards/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-19T10:45:10Z"}]}}],"modified":"2026-10-03T16:12:42.817124805Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:38467a80-92a2-453f-8a3f-0ee8b7370d5e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5ph3-pf5p-vprv","advisory_id":"38467a80-92a2-453f-8a3f-0ee8b7370d5e","event_types":["advisory"],"published_at":"2026-10-26T04:38:27.546479+00:00","technologies":["core-osv","opensearch-dashboards-2-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:01:20+00:00","detail_url":"/events/76028"}]}},{"id":73587,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-pp4h-66vv-x88j","summary":"CGA-pp4h-66vv-x88j","evidence":"osv:CGA-pp4h-66vv-x88j","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pp4h-66vv-x88j","aliases":["CGA-pp4h-66vv-x88j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pp4h-66vv-x88j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:37:06Z"}]}}],"modified":"2026-10-03T16:12:42.070398017Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b0efdab3-394e-42fb-adb5-1f7da573acfd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pp4h-66vv-x88j","advisory_id":"b0efdab3-394e-42fb-adb5-1f7da573acfd","event_types":["advisory"],"published_at":"2026-10-26T04:37:09.24943+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:32:37+00:00","detail_url":"/advisories/advisory%3Ab0efdab3-394e-42fb-adb5-1f7da573acfd","group":{"id":"advisory:b0efdab3-394e-42fb-adb5-1f7da573acfd","revision":1,"primary_event_id":75989,"change":"published","superseded_by":[],"changed":{"id":75989,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-pp4h-66vv-x88j","summary":"CGA-pp4h-66vv-x88j","evidence":"osv:CGA-pp4h-66vv-x88j","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pp4h-66vv-x88j","aliases":["CGA-pp4h-66vv-x88j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pp4h-66vv-x88j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:37:06Z"}]}}],"modified":"2026-10-03T16:12:42.070398017Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b0efdab3-394e-42fb-adb5-1f7da573acfd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pp4h-66vv-x88j","advisory_id":"b0efdab3-394e-42fb-adb5-1f7da573acfd","event_types":["advisory"],"published_at":"2026-10-26T04:37:09.24943+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:32:37+00:00","detail_url":"/events/75989"},"members":[{"id":75989,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-pp4h-66vv-x88j","summary":"CGA-pp4h-66vv-x88j","evidence":"osv:CGA-pp4h-66vv-x88j","products":[{"name":{"value":"hono-adapter-mqtt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pp4h-66vv-x88j","aliases":["CGA-pp4h-66vv-x88j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-adapter-mqtt","purl":"pkg:apk/chainguard/hono-adapter-mqtt?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pp4h-66vv-x88j.json"},"ecosystem_specific":{"components":[{"component_name":"hono-adapter-mqtt","component_purl":"pkg:apk/hono-adapter-mqtt@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T14:37:06Z"}]}}],"modified":"2026-10-03T16:12:42.070398017Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b0efdab3-394e-42fb-adb5-1f7da573acfd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pp4h-66vv-x88j","advisory_id":"b0efdab3-394e-42fb-adb5-1f7da573acfd","event_types":["advisory"],"published_at":"2026-10-26T04:37:09.24943+00:00","technologies":["core-osv","hono-adapter-mqtt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:32:37+00:00","detail_url":"/events/75989"}]}},{"id":73556,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5xg3-7gq2-v9w6","summary":"CGA-5xg3-7gq2-v9w6","evidence":"osv:CGA-5xg3-7gq2-v9w6","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5xg3-7gq2-v9w6","aliases":["CGA-5xg3-7gq2-v9w6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5xg3-7gq2-v9w6.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:49:45Z"}]}}],"modified":"2026-10-03T16:12:41.559245544Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67ba99ec-6913-4b8b-bc9e-890dcd6b90af","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5xg3-7gq2-v9w6","advisory_id":"67ba99ec-6913-4b8b-bc9e-890dcd6b90af","event_types":["advisory"],"published_at":"2026-10-26T04:35:20.147894+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:25:13+00:00","detail_url":"/advisories/advisory%3A67ba99ec-6913-4b8b-bc9e-890dcd6b90af","group":{"id":"advisory:67ba99ec-6913-4b8b-bc9e-890dcd6b90af","revision":1,"primary_event_id":75951,"change":"published","superseded_by":[],"changed":{"id":75951,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5xg3-7gq2-v9w6","summary":"CGA-5xg3-7gq2-v9w6","evidence":"osv:CGA-5xg3-7gq2-v9w6","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5xg3-7gq2-v9w6","aliases":["CGA-5xg3-7gq2-v9w6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5xg3-7gq2-v9w6.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:49:45Z"}]}}],"modified":"2026-10-03T16:12:41.559245544Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67ba99ec-6913-4b8b-bc9e-890dcd6b90af","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5xg3-7gq2-v9w6","advisory_id":"67ba99ec-6913-4b8b-bc9e-890dcd6b90af","event_types":["advisory"],"published_at":"2026-10-26T04:35:20.147894+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:25:13+00:00","detail_url":"/events/75951"},"members":[{"id":75951,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-5xg3-7gq2-v9w6","summary":"CGA-5xg3-7gq2-v9w6","evidence":"osv:CGA-5xg3-7gq2-v9w6","products":[{"name":{"value":"hono-service-auth","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5xg3-7gq2-v9w6","aliases":["CGA-5xg3-7gq2-v9w6"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"hono-service-auth","purl":"pkg:apk/chainguard/hono-service-auth?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5xg3-7gq2-v9w6.json"},"ecosystem_specific":{"components":[{"component_name":"hono-service-auth","component_purl":"pkg:apk/hono-service-auth@2.7.0-r41","component_type":"apk","component_version":"2.7.0-r41","component_location":"/.PKGINFO","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-09-28T13:49:45Z"}]}}],"modified":"2026-10-03T16:12:41.559245544Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67ba99ec-6913-4b8b-bc9e-890dcd6b90af","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5xg3-7gq2-v9w6","advisory_id":"67ba99ec-6913-4b8b-bc9e-890dcd6b90af","event_types":["advisory"],"published_at":"2026-10-26T04:35:20.147894+00:00","technologies":["core-osv","hono-service-auth"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T13:25:13+00:00","detail_url":"/events/75951"}]}},{"id":73497,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fmf4-8vcc-7g97","summary":"CGA-fmf4-8vcc-7g97","evidence":"osv:CGA-fmf4-8vcc-7g97","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fmf4-8vcc-7g97","aliases":["CGA-fmf4-8vcc-7g97"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fmf4-8vcc-7g97.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:20:07Z"}]}}],"modified":"2026-10-03T16:12:40.292510782Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450c6163-705f-4af9-8f17-312fa094ccf4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fmf4-8vcc-7g97","advisory_id":"450c6163-705f-4af9-8f17-312fa094ccf4","event_types":["advisory"],"published_at":"2026-10-26T04:33:43.186366+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:55:53+00:00","detail_url":"/advisories/advisory%3A450c6163-705f-4af9-8f17-312fa094ccf4","group":{"id":"advisory:450c6163-705f-4af9-8f17-312fa094ccf4","revision":1,"primary_event_id":75890,"change":"published","superseded_by":[],"changed":{"id":75890,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fmf4-8vcc-7g97","summary":"CGA-fmf4-8vcc-7g97","evidence":"osv:CGA-fmf4-8vcc-7g97","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fmf4-8vcc-7g97","aliases":["CGA-fmf4-8vcc-7g97"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fmf4-8vcc-7g97.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:20:07Z"}]}}],"modified":"2026-10-03T16:12:40.292510782Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450c6163-705f-4af9-8f17-312fa094ccf4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fmf4-8vcc-7g97","advisory_id":"450c6163-705f-4af9-8f17-312fa094ccf4","event_types":["advisory"],"published_at":"2026-10-26T04:33:43.186366+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:55:53+00:00","detail_url":"/events/75890"},"members":[{"id":75890,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-fmf4-8vcc-7g97","summary":"CGA-fmf4-8vcc-7g97","evidence":"osv:CGA-fmf4-8vcc-7g97","products":[{"name":{"value":"kibana-9.1-iamguarded","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fmf4-8vcc-7g97","aliases":["CGA-fmf4-8vcc-7g97"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1-iamguarded","purl":"pkg:apk/chainguard/kibana-9.1-iamguarded?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fmf4-8vcc-7g97.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/opt/iamguarded/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T22:20:07Z"}]}}],"modified":"2026-10-03T16:12:40.292510782Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:450c6163-705f-4af9-8f17-312fa094ccf4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fmf4-8vcc-7g97","advisory_id":"450c6163-705f-4af9-8f17-312fa094ccf4","event_types":["advisory"],"published_at":"2026-10-26T04:33:43.186366+00:00","technologies":["core-osv","kibana-9-1-iamguarded"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:55:53+00:00","detail_url":"/events/75890"}]}},{"id":73492,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-xpqx-pgp7-86ww","summary":"CGA-xpqx-pgp7-86ww","evidence":"osv:CGA-xpqx-pgp7-86ww","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xpqx-pgp7-86ww","aliases":["CGA-xpqx-pgp7-86ww"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}}],"modified":"2026-10-03T16:12:40.209036075Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c1114041-6b71-44bd-b385-dae7757af926","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpqx-pgp7-86ww","advisory_id":"c1114041-6b71-44bd-b385-dae7757af926","event_types":["advisory"],"published_at":"2026-10-26T04:33:24.446182+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:33+00:00","detail_url":"/advisories/advisory%3Ac1114041-6b71-44bd-b385-dae7757af926","group":{"id":"advisory:c1114041-6b71-44bd-b385-dae7757af926","revision":1,"primary_event_id":75884,"change":"published","superseded_by":[],"changed":{"id":75884,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-xpqx-pgp7-86ww","summary":"CGA-xpqx-pgp7-86ww","evidence":"osv:CGA-xpqx-pgp7-86ww","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xpqx-pgp7-86ww","aliases":["CGA-xpqx-pgp7-86ww"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}}],"modified":"2026-10-03T16:12:40.209036075Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c1114041-6b71-44bd-b385-dae7757af926","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpqx-pgp7-86ww","advisory_id":"c1114041-6b71-44bd-b385-dae7757af926","event_types":["advisory"],"published_at":"2026-10-26T04:33:24.446182+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:33+00:00","detail_url":"/events/75884"},"members":[{"id":75884,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-xpqx-pgp7-86ww","summary":"CGA-xpqx-pgp7-86ww","evidence":"osv:CGA-xpqx-pgp7-86ww","products":[{"name":{"value":"langfuse-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"langfuse-3-worker","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xpqx-pgp7-86ww","aliases":["CGA-xpqx-pgp7-86ww"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/chainguard/langfuse-3-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-3-worker","purl":"pkg:apk/wolfi/langfuse-3-worker?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xpqx-pgp7-86ww.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T12:56:26Z"}]}}],"modified":"2026-10-03T16:12:40.209036075Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c1114041-6b71-44bd-b385-dae7757af926","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xpqx-pgp7-86ww","advisory_id":"c1114041-6b71-44bd-b385-dae7757af926","event_types":["advisory"],"published_at":"2026-10-26T04:33:24.446182+00:00","technologies":["core-osv","langfuse-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:33+00:00","detail_url":"/events/75884"}]}},{"id":73430,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-94j7-g82f-cj5x","summary":"CGA-94j7-g82f-cj5x","evidence":"osv:CGA-94j7-g82f-cj5x","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-94j7-g82f-cj5x","aliases":["CGA-94j7-g82f-cj5x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-94j7-g82f-cj5x.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T20:30:44Z"}]}}],"modified":"2026-10-03T16:12:38.928633038Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d67257b-922d-4a19-b389-85dfdf570276","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-94j7-g82f-cj5x","advisory_id":"0d67257b-922d-4a19-b389-85dfdf570276","event_types":["advisory"],"published_at":"2026-10-26T04:31:47.861494+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:38+00:00","detail_url":"/advisories/advisory%3A0d67257b-922d-4a19-b389-85dfdf570276","group":{"id":"advisory:0d67257b-922d-4a19-b389-85dfdf570276","revision":1,"primary_event_id":75818,"change":"published","superseded_by":[],"changed":{"id":75818,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-94j7-g82f-cj5x","summary":"CGA-94j7-g82f-cj5x","evidence":"osv:CGA-94j7-g82f-cj5x","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-94j7-g82f-cj5x","aliases":["CGA-94j7-g82f-cj5x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-94j7-g82f-cj5x.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T20:30:44Z"}]}}],"modified":"2026-10-03T16:12:38.928633038Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d67257b-922d-4a19-b389-85dfdf570276","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-94j7-g82f-cj5x","advisory_id":"0d67257b-922d-4a19-b389-85dfdf570276","event_types":["advisory"],"published_at":"2026-10-26T04:31:47.861494+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:38+00:00","detail_url":"/events/75818"},"members":[{"id":75818,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-94j7-g82f-cj5x","summary":"CGA-94j7-g82f-cj5x","evidence":"osv:CGA-94j7-g82f-cj5x","products":[{"name":{"value":"kibana-9.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.1.10-r7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-94j7-g82f-cj5x","aliases":["CGA-94j7-g82f-cj5x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.10-r7"}]}],"package":{"name":"kibana-9.1","purl":"pkg:apk/chainguard/kibana-9.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-94j7-g82f-cj5x.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.3","component_type":"npm","component_version":"4.12.3","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-18T20:30:44Z"}]}}],"modified":"2026-10-03T16:12:38.928633038Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0d67257b-922d-4a19-b389-85dfdf570276","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-94j7-g82f-cj5x","advisory_id":"0d67257b-922d-4a19-b389-85dfdf570276","event_types":["advisory"],"published_at":"2026-10-26T04:31:47.861494+00:00","technologies":["core-osv","kibana-9-1"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T01:31:38+00:00","detail_url":"/events/75818"}]}},{"id":73415,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j4pw-7rmv-qg73","summary":"CGA-j4pw-7rmv-qg73","evidence":"osv:CGA-j4pw-7rmv-qg73","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j4pw-7rmv-qg73","aliases":["CGA-j4pw-7rmv-qg73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4pw-7rmv-qg73.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T19:05:57Z"}]}}],"modified":"2026-10-03T16:12:38.683503895Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4558bdd-c6b6-4f4a-be4b-12237f970c29","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4pw-7rmv-qg73","advisory_id":"a4558bdd-c6b6-4f4a-be4b-12237f970c29","event_types":["advisory"],"published_at":"2026-10-26T04:29:53.185063+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:08:42+00:00","detail_url":"/advisories/advisory%3Aa4558bdd-c6b6-4f4a-be4b-12237f970c29","group":{"id":"advisory:a4558bdd-c6b6-4f4a-be4b-12237f970c29","revision":1,"primary_event_id":75791,"change":"published","superseded_by":[],"changed":{"id":75791,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j4pw-7rmv-qg73","summary":"CGA-j4pw-7rmv-qg73","evidence":"osv:CGA-j4pw-7rmv-qg73","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j4pw-7rmv-qg73","aliases":["CGA-j4pw-7rmv-qg73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4pw-7rmv-qg73.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T19:05:57Z"}]}}],"modified":"2026-10-03T16:12:38.683503895Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4558bdd-c6b6-4f4a-be4b-12237f970c29","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4pw-7rmv-qg73","advisory_id":"a4558bdd-c6b6-4f4a-be4b-12237f970c29","event_types":["advisory"],"published_at":"2026-10-26T04:29:53.185063+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:08:42+00:00","detail_url":"/events/75791"},"members":[{"id":75791,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-j4pw-7rmv-qg73","summary":"CGA-j4pw-7rmv-qg73","evidence":"osv:CGA-j4pw-7rmv-qg73","products":[{"name":{"value":"kibana-9.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.2.6-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j4pw-7rmv-qg73","aliases":["CGA-j4pw-7rmv-qg73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.6-r1"}]}],"package":{"name":"kibana-9.2","purl":"pkg:apk/chainguard/kibana-9.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4pw-7rmv-qg73.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.5","component_type":"npm","component_version":"4.12.5","component_location":"/usr/share/kibana/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-17T19:05:57Z"}]}}],"modified":"2026-10-03T16:12:38.683503895Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4558bdd-c6b6-4f4a-be4b-12237f970c29","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4pw-7rmv-qg73","advisory_id":"a4558bdd-c6b6-4f4a-be4b-12237f970c29","event_types":["advisory"],"published_at":"2026-10-26T04:29:53.185063+00:00","technologies":["core-osv","kibana-9-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:08:42+00:00","detail_url":"/events/75791"}]}},{"id":73401,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-c8wp-rc8m-jmmp","summary":"CGA-c8wp-rc8m-jmmp","evidence":"osv:CGA-c8wp-rc8m-jmmp","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c8wp-rc8m-jmmp","aliases":["CGA-c8wp-rc8m-jmmp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8wp-rc8m-jmmp.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:27:43Z"}]}}],"modified":"2026-10-03T16:12:38.367527962Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e7a1ce5-89ec-45e3-bf3e-efa42942b175","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8wp-rc8m-jmmp","advisory_id":"8e7a1ce5-89ec-45e3-bf3e-efa42942b175","event_types":["advisory"],"published_at":"2026-10-26T04:27:46.659022+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:32:42+00:00","detail_url":"/advisories/advisory%3A8e7a1ce5-89ec-45e3-bf3e-efa42942b175","group":{"id":"advisory:8e7a1ce5-89ec-45e3-bf3e-efa42942b175","revision":1,"primary_event_id":75764,"change":"published","superseded_by":[],"changed":{"id":75764,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-c8wp-rc8m-jmmp","summary":"CGA-c8wp-rc8m-jmmp","evidence":"osv:CGA-c8wp-rc8m-jmmp","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c8wp-rc8m-jmmp","aliases":["CGA-c8wp-rc8m-jmmp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8wp-rc8m-jmmp.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:27:43Z"}]}}],"modified":"2026-10-03T16:12:38.367527962Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e7a1ce5-89ec-45e3-bf3e-efa42942b175","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8wp-rc8m-jmmp","advisory_id":"8e7a1ce5-89ec-45e3-bf3e-efa42942b175","event_types":["advisory"],"published_at":"2026-10-26T04:27:46.659022+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:32:42+00:00","detail_url":"/events/75764"},"members":[{"id":75764,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"CGA-c8wp-rc8m-jmmp","summary":"CGA-c8wp-rc8m-jmmp","evidence":"osv:CGA-c8wp-rc8m-jmmp","products":[{"name":{"value":"langfuse-fips-3-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.158.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c8wp-rc8m-jmmp","aliases":["CGA-c8wp-rc8m-jmmp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.158.0-r0"}]}],"package":{"name":"langfuse-fips-3-worker","purl":"pkg:apk/chainguard/langfuse-fips-3-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8wp-rc8m-jmmp.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.12.6","component_type":"npm","component_version":"4.12.6","component_location":"/app/node_modules/.pnpm/hono@4.12.6/node_modules/hono/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-03-13T13:27:43Z"}]}}],"modified":"2026-10-03T16:12:38.367527962Z","provider":"osv","upstream":["CVE-2026-56763","GHSA-3wcj-gjvf-fvch","GHSA-v8w9-8mx6-g223"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56763.json","https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"]},"related_cves":[{"value":"CVE-2026-56763","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e7a1ce5-89ec-45e3-bf3e-efa42942b175","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-56763","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8wp-rc8m-jmmp","advisory_id":"8e7a1ce5-89ec-45e3-bf3e-efa42942b175","event_types":["advisory"],"published_at":"2026-10-26T04:27:46.659022+00:00","technologies":["core-osv","langfuse-fips-3-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-12T00:32:42+00:00","detail_url":"/events/75764"}]}},{"id":70991,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/advisories/osv%3AGHSA-v8w9-8mx6-g223","group":{"id":"osv:GHSA-v8w9-8mx6-g223","revision":1,"primary_event_id":71365,"change":"published","superseded_by":[],"changed":{"id":71365,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/events/71365"},"members":[{"id":71365,"cve_ids":["CVE-2026-56763"],"payload":{"kind":"advisory","title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","summary":"## Summary When using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. ## Details The `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names. In previous versions, the `__proto__` path segment was not filtered. As a result, specially crafted keys such as `__proto__.x` could produce objects containing `__proto__` properties. While this behavior does not directly modify `Object.prototype` within Hono itself, it may become exploitable if the parsed result is later merged into regular JavaScript objects using unsafe merge patterns. ## Impact Applications that merge parsed form data into regular objects using unsafe patterns (for example recursive deep merge utilities) may become vulnerable to prototype pollution.","evidence":"osv:GHSA-v8w9-8mx6-g223","products":[{"name":{"value":"hono","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.12.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"GHSA-v8w9-8mx6-g223","aliases":["CVE-2026-56763","GHSA-v8w9-8mx6-g223"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.7"}]}],"package":{"name":"hono","purl":"pkg:npm/hono","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v8w9-8mx6-g223/GHSA-v8w9-8mx6-g223.json"}}],"modified":"2026-10-02T22:45:04.525587715Z","provider":"osv","references":["https://github.com/honojs/hono/security/advisories/GHSA-v8w9-8mx6-g223","https://nvd.nist.gov/vuln/detail/CVE-2026-56763","https://github.com/honojs/hono/commit/ef902257e0beacbb83d2a9549b3b83e03514a6fe","https://github.com/honojs/hono","https://www.vulncheck.com/advisories/hono-prototype-pollution-via-proto-key-in-parsebody-with-dot-option"],"provider_metadata":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-03-11T00:31:47Z"}},"related_cves":[{"value":"CVE-2026-56763","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"osv:GHSA-v8w9-8mx6-g223","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223","advisory_id":"22be7d5c-1a96-4280-a5f8-6152aa6a6b00","event_types":["advisory"],"published_at":"2026-10-25T22:46:13.148222+00:00","technologies":["core-osv","hono"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-11T00:31:47+00:00","detail_url":"/events/71365"}]}}],"next_after":74257,"next_before":70991}