Junglewise Threat Intelligence

CVE-2026-54288: Hono Body Limit Middleware bypass on AWS Lambda

CVE-2026-54288 · Severity: medium · CVSS 6.5 · Published 2026-06-22

Technologies: Honojs Hono. Vendors: npm.

Executive brief

Hono is a web application framework used to build services on various JavaScript runtimes. A vulnerability in its body-limiting feature allows attackers to bypass size restrictions when the application is hosted on AWS Lambda. This could lead to increased resource consumption and costs by forcing the application to process unexpectedly large data payloads.

Technical details

The Body Limit Middleware in Hono prior to version 4.12.25 relies on the 'Content-Length' header to enforce request size limits. When deployed on AWS Lambda (including API Gateway, ALB, and Lambda@Edge), the adapter reconstructs the request from a buffered payload and trusts the client-provided header. An attacker can send a large request body while declaring a small 'Content-Length' in the header, bypassing the middleware's check. While the platform's own request limits still apply, this allows for increased CPU and memory consumption per invocation. The issue is resolved in version 4.12.25.

Affected products

  • honojs Hono < 4.12.25

Timeline

  • 2026-06-09: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: NVD publication date

References

Related threats