Executive brief
Hono is a web application framework used to build services on various JavaScript runtimes. A vulnerability in its body-limiting feature allows attackers to bypass size restrictions when the application is hosted on AWS Lambda. This could lead to increased resource consumption and costs by forcing the application to process unexpectedly large data payloads.
Technical details
The Body Limit Middleware in Hono prior to version 4.12.25 relies on the 'Content-Length' header to enforce request size limits. When deployed on AWS Lambda (including API Gateway, ALB, and Lambda@Edge), the adapter reconstructs the request from a buffered payload and trusts the client-provided header. An attacker can send a large request body while declaring a small 'Content-Length' in the header, bypassing the middleware's check. While the platform's own request limits still apply, this allows for increased CPU and memory consumption per invocation. The issue is resolved in version 4.12.25.
Affected products
- honojs Hono < 4.12.25
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date