Body Limit Middleware Vulnerability in Hono Web Application Framework

CVE-2026-54288

What is CVE-2026-54288?

The Hono Web Application Framework, prior to version 4.12.25, has a vulnerability within its Body Limit Middleware that allows an attacker to manipulate the Content-Length header of incoming requests. This can lead to scenarios where a client sends a smaller stated Content-Length while uploading a significantly larger payload, bypassing configured body size limits. This vulnerability is particularly relevant in cloud environments like AWS Lambda, where body requests can be fully buffered. This issue could expose applications to various forms of attacks stemming from unregulated request sizes. The vulnerability has been addressed in version 4.12.25.

References