6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54288

CVE-2026-54288: hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Summary

The Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a much larger body, slipping past the limit.

Details

When Content-Length is present and Transfer-Encoding is absent, the middleware compares the declared value against the limit and passes the request through if it is small enough. On standards-based runtimes the transport enforces that Content-Length matches the body, so this is safe. The Lambda adapters instead reconstruct the request from a buffered payload and copy the client's Content-Length verbatim, so the declared length and the real body size are decoupled.

This issue affects applications deployed on AWS Lambda that rely on the Body Limit Middleware to cap request body size.

Impact

The declared body-size limit can be bypassed: a handler reads a payload larger than the configured maximum. Processing the oversized payload (large JSON, multipart, etc.) consumes additional CPU and memory per request. The payload remains bounded by the platform's request size limits, and Lambda isolates invocations, so the impact is increased per-request resource usage rather than full denial of service. This affects applications deployed on AWS Lambda that use the Body Limit Middleware.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54288

CVE-2026-54288:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.12.25	4.12.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in how Hono's AWS Lambda adapters handle incoming requests. The bodyLimit middleware relies on the Content-Length header to determine if a request body exceeds the configured size limit. However, on AWS Lambda platforms (including API Gateway, ALB, and Lambda@Edge), the entire request body is buffered and passed to the handler regardless of the client-declared Content-Length.

The analysis of the patch commits between the vulnerable version 4.12.24 and the patched version 4.12.25 revealed that the core issue was in the request creation logic within the Lambda adapters. Specifically, commit fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b addresses the problem.

The vulnerable functions, EventProcessor.createRequest in src/adapter/aws-lambda/handler.ts and createRequest in src/adapter/lambda-edge/handler.ts, were responsible for constructing a standard Request object from the platform-specific Lambda event. Before the patch, these functions did not calculate the actual size of the received request body and overwrite the Content-Length header. This meant that a mismatched (and smaller) Content-Length sent by a client would be passed to the Hono application and its middleware.

The patch rectifies this by introducing logic in both functions to encode the body, calculate its actual byte length, and use this value to explicitly set the Content-Length header on the new Request object. This ensures that the bodyLimit middleware receives the correct size and can effectively enforce the limit, mitigating the bypass vulnerability.

Vulnerable functions

EventProcessor.createRequest

src/adapter/aws-lambda/handler.ts

The `createRequest` method within the `EventProcessor` class (and its subclasses for different Lambda event types) was vulnerable because it trusted the `Content-Length` header provided by the client. When running on AWS Lambda, the entire request body is buffered. This function would construct a new `Request` object, but it would either use the original (and potentially understated) `Content-Length` from the client headers or not set one at all if the body was processed, allowing the `bodyLimit` middleware to be bypassed. The patch fixes this by recalculating the body's length and setting a correct `Content-Length` header on the newly created `Request` object before it's passed to the middleware chain.

createRequest

src/adapter/lambda-edge/handler.ts

Similar to the other Lambda adapters, the `createRequest` function for Lambda@Edge was vulnerable. It would create a new `Request` object from the CloudFront event data but failed to verify and set the correct `Content-Length` based on the actual size of the request body received from the event. This allowed a malicious client to understate the `Content-Length` header and bypass the `bodyLimit` middleware. The fix involves explicitly calculating the byte length of the body and setting the `content-length` header, ensuring the subsequent middleware has accurate information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.