Quick answers
- Is CVE-2026-54288 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54288 being exploited in the wild.
- How severe is CVE-2026-54288?
- Medium severity, with a CVSS score of 6.5, published 22 June 2026.
- Which products and versions are affected?
- hono (npm) < 4.12.25, SEMVER:introduced=0,fixed=4.12.25.
- Is there a fix for CVE-2026-54288?
- Yes. hono (npm): upgrade to 4.12.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54288 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-54288?
- Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- hono (npm): upgrade to 4.12.25 or later
npm install hono@4.12.25
Technical details
The Body Limit Middleware in Hono prior to version 4.12.25 relies on the 'Content-Length' header to enforce request size limits. When deployed on AWS Lambda (including API Gateway, ALB, and Lambda@Edge), the adapter reconstructs the request from a buffered payload and trusts the client-provided header. An attacker can send a large request body while declaring a small 'Content-Length' in the header, bypassing the middleware's check. While the platform's own request limits still apply, this allows for increased CPU and memory consumption per invocation. The issue is resolved in version 4.12.25.
Affected products
- honojs Hono < 4.12.25
Identifiers
- CVE-2026-54288
- GHSA-rv63-4mwf-qqc2
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date