Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit. This vulnerability is fixed in 4.12.25.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25,
    the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within
    the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered
    fully buffered and the adapter builds the request with the client-declared Content-Length, which need not
    match the actual payload. A client can declare a tiny Content-Length while sending a much larger body,
    slipping past the limit. This vulnerability is fixed in 4.12.25. (CVE-2026-54288)

ID	Name	Product	Family	Type	Severity
460071	Echo: hono: security update to 4.12.25	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460071	Echo: hono: security update to 4.12.25	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443274	SCA: security update for hono (GHSA-rv63-4mwf-qqc2)	Tenable Cloud Security	SCA Checks	Local	medium
443274	SCA: security update for hono (GHSA-rv63-4mwf-qqc2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54288

medium

Tenable Plugins

medium

medium

medium

medium