CVE-2026-54288 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25.
A vulnerability exists in the Hono web application framework, specifically in versions prior to 4.12.25, within the Body Limit Middleware. This middleware improperly trusts the Content-Length header from requests to determine if the body size is within acceptable limits. On AWS Lambda environments (including API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge), the body is fully buffered and the request is constructed using the client's declared Content-Length, which can be misleading. This allows clients to send larger bodies than indicated, bypassing the size limit. As a result, handlers may process oversized payloads, such as large JSON or multipart data, leading to increased CPU and memory usage per request, although the overall impact is limited by Lambda's request size constraints and invocation isolation.
Users can upgrade to Hono version 4.12.25 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hono | < 4.12.25 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |