{"id":"CVE-2026-44456","aliases":["EUVD-2026-30035","GHSA-9vqf-7f2p-gf9v","ROOT-APP-NPM-CVE-2026-44456"],"status":"published","title":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00219,"percentile":0.12499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-05-06T23:50:10Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"hono","fixed_in":["4.12.16"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/hono","fixed_in":["4.12.14-root.io.3","4.12.14-root.io.2","4.12.14-root.io.4","4.12.14-root.io.5","4.12.14-root.io.6","4.12.14-root.io.7","4.12.14-root.io.8","4.12.12-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"hono","fixed_in":["4.12.14-aikido.3","4.12.14-aikido.4","4.12.14-aikido.5","4.12.14-aikido.6","4.12.14-aikido.7","4.12.14-aikido.8","4.12.12-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.16"}]}]},{"source":"osv","ecosystem":"npm","package":"hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.16"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-root.io.3"},{"fixed":"4.12.14-root.io.2"},{"fixed":"4.12.14-root.io.4"},{"fixed":"4.12.14-root.io.5"},{"fixed":"4.12.14-root.io.6"},{"fixed":"4.12.14-root.io.7"},{"fixed":"4.12.14-root.io.8"},{"fixed":"4.12.12-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.14-aikido.3"},{"fixed":"4.12.14-aikido.4"},{"fixed":"4.12.14-aikido.5"},{"fixed":"4.12.14-aikido.6"},{"fixed":"4.12.14-aikido.7"},{"fixed":"4.12.14-aikido.8"},{"fixed":"4.12.12-aikido.2"}]}]}],"products":[{"vendor":"hono","product":"hono"},{"vendor":"honojs","product":"hono"}],"references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44456","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vqf-7f2p-gf9v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44456.json","tags":["advisory"]},{"url":"https://github.com/honojs/hono","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44456","title":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","status":"published","published":"2026-05-13T14:58:08.451Z","modified":"2026-05-13T15:31:19.896Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30035","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","status":"published","published":"2026-05-13T14:58:08Z","modified":"2026-05-13T15:31:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:33.75998Z"}],"ghsa":[{"id":"GHSA-9vqf-7f2p-gf9v","title":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","description":"## Summary\n\n`bodyLimit()` does not reliably enforce `maxSize` for requests without a usable `Content-Length` (e.g. `Transfer-Encoding: chunked`). Oversized requests can reach handlers and return `200` instead of `413`.\n\n## Details\n\nFor chunked / unknown-length requests, `bodyLimit()` wraps the body in a stream that counts bytes asynchronously, then runs the handler before the size decision is final. The `413` is only applied afterwards by checking `c.error`.\n\nThis lets the limit be bypassed when:\n\n- the handler does not read the body,\n- the handler reads only the first chunk(s) and returns, or\n- the handler reads the body but swallows the read error in `try/catch`.\n\nIn all three cases the handler returns `200` before the limit check completes (or its result is observed).\n\nThe fix is to enforce the size decision before `next()` runs, instead of retrofitting the response via `c.error` afterwards.\n\n## Impact\n\nApplications relying on `bodyLimit()` as a hard boundary can be bypassed: oversized chunked requests can reach handler logic and return successful responses. Per-request data exposure is bounded by `maxSize`, but the documented guarantee — \"oversized requests are rejected before business logic runs\" — does not hold.\n\n## Credits\n\n- @lalalala5678 (slow chunked / early return variants)\n- @Jvr2022 (error handling bypass)","status":"published","published":"2026-05-06T23:50:10Z","modified":"2026-05-14T20:32:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44456","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","status":"published","published":"2026-05-13T16:16:57.567Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-44456","title":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","status":"published","published":"2026-05-13T14:58:08.451Z","modified":"2026-10-28T02:30:39.447556439Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-9vqf-7f2p-gf9v","title":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","description":"## Summary\n\n`bodyLimit()` does not reliably enforce `maxSize` for requests without a usable `Content-Length` (e.g. `Transfer-Encoding: chunked`). Oversized requests can reach handlers and return `200` instead of `413`.\n\n## Details\n\nFor chunked / unknown-length requests, `bodyLimit()` wraps the body in a stream that counts bytes asynchronously, then runs the handler before the size decision is final. The `413` is only applied afterwards by checking `c.error`.\n\nThis lets the limit be bypassed when:\n\n- the handler does not read the body,\n- the handler reads only the first chunk(s) and returns, or\n- the handler reads the body but swallows the read error in `try/catch`.\n\nIn all three cases the handler returns `200` before the limit check completes (or its result is observed).\n\nThe fix is to enforce the size decision before `next()` runs, instead of retrofitting the response via `c.error` afterwards.\n\n## Impact\n\nApplications relying on `bodyLimit()` as a hard boundary can be bypassed: oversized chunked requests can reach handler logic and return successful responses. Per-request data exposure is bounded by `maxSize`, but the documented guarantee — \"oversized requests are rejected before business logic runs\" — does not hold.\n\n## Credits\n\n- @lalalala5678 (slow chunked / early return variants)\n- @Jvr2022 (error handling bypass)","status":"published","published":"2026-05-06T23:50:10Z","modified":"2026-09-10T03:50:46.398393701Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"ROOT-APP-NPM-CVE-2026-44456","title":"CVE-2026-44456 in @rootio/hono - Patched by Root","description":"Root has patched CVE-2026-44456 in the @rootio/hono package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-27T08:20:49Z","modified":"2026-07-27T13:15:13.800086774Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"}]}}