{"id":"EUVD-2026-30035","enisaUuid":"efa4e827-01db-335c-9ca0-b9068a18ec8b","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","datePublished":"May 13, 2026, 2:58:08 PM","dateUpdated":"May 13, 2026, 3:31:19 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v\n","aliases":"CVE-2026-44456\nGHSA-9vqf-7f2p-gf9v\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"03053707-e029-3cdb-8838-f1bad0f9facc","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.16"}],"enisaIdVendor":[{"id":"2f16af2e-c8e9-3d86-9dc9-89b2ba2ad5d8","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"415e588b-c90f-342f-b0d4-ab91cfbb3966","vulnerability":{"id":"GHSA-9vqf-7f2p-gf9v","description":"Hono: bodyLimit() can be bypassed for chunked / unknown-length requests","datePublished":"May 6, 2026, 11:50:10 PM","dateUpdated":"May 14, 2026, 8:32:03 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44456\nhttps://github.com/honojs/hono\n","enisa_id":"EUVD-2026-30035\n","aliases":"GHSA-9vqf-7f2p-gf9v\nCVE-2026-44456\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"880b68f4-5163-349c-bd61-a71a59251642","vulnerability":{"id":"CVE-2026-44456","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.","datePublished":"May 13, 2026, 2:58:08 PM","dateUpdated":"May 13, 2026, 3:31:19 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-9vqf-7f2p-gf9v\n","enisa_id":"EUVD-2026-30035\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"ee7c1298-3cdb-3513-b294-ed242438e154","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.16"}],"vulnerabilityVendor":[{"id":"7b517d72-7f65-3639-9028-a18f51e28bb9","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}