CVE-2026-54288

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.25

Description The Body Limit Middleware trusts the Content-Length header to determine if a request body is within the allowed limit. In environments such as AWS Lambda (including API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge), the body is delivered fully buffered, and the adapter reconstructs the request using the client-declared Content-Length without verifying if it matches the actual payload size. This allows a client to specify a small Content-Length while sending a significantly larger body, bypassing the configured limit. When Content-Length is present and Transfer-Encoding is absent, the middleware permits the request if the declared value is small enough. This can lead to increased CPU and memory consumption per request as handlers process oversized payloads, although the impact is limited by the platform's overall request size limits.

Recommendations Update to version 4.12.25.