CVE-2026-54288 Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Attackers can bypass body size limits in Hono on AWS Lambda by spoofing Content-Length, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54288?
CVE-2026-54288 is a medium-severity vulnerability in honojs hono, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25.
Weakness: CWE-345
Which versions are affected by CVE-2026-54288?
2 open source packages ship an affected version, including hono.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.12.25 |
hono npm | All versions | 4.12.25 |
How do I fix CVE-2026-54288?
Upgrade hono to 4.12.25 or later.
Is CVE-2026-54288 being exploited?
There is no known exploitation of CVE-2026-54288 in the wild and no public exploit code.
Sources
Also known as ECHO-972b-f731-a0eb, GHSA-rv63-4mwf-qqc2, MINI-3gxf-929p-c85g, MINI-3rqp-fpc4-6cq4, MINI-7wxg-qr2m-774g, MINI-c6w5-h6hv-7h7w and 9 more.