The honojs hono framework versions before 4.12.16 contain an uncontrolled resource consumption vulnerability (CWE-400) due to improper enforcement of maxSize limits in the bodyLimit() function for requests without a usable Content-Length header. Specifically, requests using Transfer-Encoding: chunked can bypass size restrictions, potentially allowing oversized payloads to be processed by the application. This can lead to resource exhaustion or other impacts related to handling unexpectedly large requests. The issue is resolved in hono version 4.12.16.

This vulnerability allows attackers to send oversized HTTP requests that bypass the intended maximum size checks, potentially causing resource exhaustion or degraded service availability. The affected versions respond with HTTP 200 OK instead of rejecting the request with HTTP 413 Payload Too Large, which may lead to unintended processing of large payloads. There is no indication of direct data confidentiality or integrity compromise. No known exploits are reported in the wild.

Upgrade to hono version 4.12.16 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 4.12.16, applying this official fix is the recommended remediation. Patch status is not explicitly stated beyond this fix, but upgrading is the definitive mitigation.