CVE-2026-54288

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la versión 4.12.25, el middleware Body Limit confía en el encabezado Content-Length de la solicitud para decidir si un cuerpo está dentro del límite. En AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice y Lambda@Edge), el cuerpo se entrega completamente almacenado en búfer y el adaptador construye la solicitud con el Content-Length declarado por el cliente, que no tiene por qué coincidir con la carga útil real. Un cliente puede declarar un Content-Length minúsculo mientras envía un cuerpo mucho más grande, eludiendo el límite. Esta vulnerabilidad está corregida en la versión 4.12.25.

Information

Published : 2026-06-22 19:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54288

Mitre link : CVE-2026-54288

CVE.ORG link : CVE-2026-54288

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-54288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:16:43.807363Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.25"}]}]}], "published": "2026-06-22T19:17:19.553", "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.12.25, el middleware Body Limit conf\u00eda en el encabezado Content-Length de la solicitud para decidir si un cuerpo est\u00e1 dentro del l\u00edmite. En AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice y Lambda@Edge), el cuerpo se entrega completamente almacenado en b\u00fafer y el adaptador construye la solicitud con el Content-Length declarado por el cliente, que no tiene por qu\u00e9 coincidir con la carga \u00fatil real. Un cliente puede declarar un Content-Length min\u00fasculo mientras env\u00eda un cuerpo mucho m\u00e1s grande, eludiendo el l\u00edmite. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.12.25."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}