CVE-2025-59139
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-59139
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59139.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-59139
- Aliases
- Published
- 2025-09-12T13:03:05.777Z
- Modified
- 2025-11-20T12:39:46.080856Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Hono has Body Limit Middleware Bypass
- Details
-
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the
bodyLimitmiddleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized theContent-Lengthheader even when aTransfer-Encoding: chunkedheader was also included. According to the HTTP specification,Content-Lengthmust be ignored in such cases. This discrepancy could allow oversized request bodies to bypass the configured limit. Most standards-compliant runtimes and reverse proxies may reject such malformed requests with400 Bad Request, so the practical impact depends on the runtime and deployment environment. If body size limits are used as a safeguard against large or malicious requests, this flaw could allow attackers to send oversized request bodies. The primary risk is denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests. The implementation has been updated to align with the HTTP specification, ensuring thatTransfer-Encodingtakes precedence overContent-Length. The issue is fixed in Hono v4.9.7, and all users should upgrade immediately. - Database specific
{ "cwe_ids": [ "CWE-400", "CWE-770" ] }- References
Affected packages
Git / github.com/honojs/hono
Affected ranges
- Type
- GIT
- Repo
- https://github.com/honojs/hono
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed