All vulnerabilities

npm

CVE-2026-44456

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

Severity: Medium 6.5
Published: 6 May 2026
Last changed: 10 Sept 2026
Added to UpHeron: 22 Oct 2026
Fixed in: 4.12.16
Also known as: GHSA-9vqf-7f2p-gf9v
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
hononpm · `osv:npm:hono`	Every version before 4.12.16

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44456
GitHub Advisory Database https://github.com/advisories/GHSA-9vqf-7f2p-gf9v