Improper Size Limitation in Hono Web Framework by HonoJS
CVE-2026-44456

6.5MEDIUM

Key Information:

Vendor

Honojs

Status
Hono
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44456?

The Hono web application framework, designed to support various JavaScript runtimes, has a vulnerability in its bodyLimit() function prior to version 4.12.16. This flaw allows for requests with oversized payloads to bypass the intended size restriction when the Content-Length is not set correctly, particularly with Transfer-Encoding: chunked requests. As a result, oversized requests can reach the application handlers, potentially leading to unexpected behaviors, including returning a success status code (200) instead of an appropriate error response (413). Users are advised to upgrade to version 4.12.16 or later to mitigate these issues.

Affected Version(s)

hono < 4.12.16

References

https://github.com/honojs/hono/security/advisories/GHSA-9...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.