CVE-2026-44456

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la 4.12.16, bodyLimit() no aplica de forma fiable maxSize para solicitudes sin un Content-Length utilizable (p. ej., Transfer-Encoding: chunked). Las solicitudes sobredimensionadas pueden alcanzar los manejadores y devolver 200 en lugar de 413. Esta vulnerabilidad está corregida en la 4.12.16.

Information

Published : 2026-05-13 16:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44456

Mitre link : CVE-2026-44456

CVE.ORG link : CVE-2026-44456

JSON object : View

Products Affected

hono

hono

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-44456", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44456", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:31:08.812961Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.16"}]}]}], "published": "2026-05-13T16:16:57.567", "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la 4.12.16, bodyLimit() no aplica de forma fiable maxSize para solicitudes sin un Content-Length utilizable (p. ej., Transfer-Encoding: chunked). Las solicitudes sobredimensionadas pueden alcanzar los manejadores y devolver 200 en lugar de 413. Esta vulnerabilidad est\u00e1 corregida en la 4.12.16."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D9D38D7B-A561-44B9-8571-C5241E5F36DE", "versionEndExcluding": "4.12.16"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}