CVE-2026-54288 describes an insufficient verification of data authenticity vulnerability (CWE-345) in the honojs hono framework. The Body Limit Middleware trusted the Content-Length header from the client to determine if the request body size was within allowed limits. However, on AWS Lambda platforms (including API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge), the body is fully buffered and the adapter constructs the request using the client-declared Content-Length, which may not match the actual payload size. This discrepancy allows an attacker to send a smaller Content-Length header while delivering a larger body, bypassing the middleware's size checks. The vulnerability is resolved in hono version 4.12.25.

An attacker can bypass the request body size limit by sending a smaller Content-Length header than the actual payload size on AWS Lambda environments. This may lead to processing of unexpectedly large request bodies, potentially causing resource exhaustion or other application-level impacts. The CVSS score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

A fix is available in hono version 4.12.25. Users should upgrade to this version or later to ensure the Body Limit Middleware correctly enforces request body size limits. Since this is a cloud-hosted service environment (AWS Lambda), the vendor manages remediation for the cloud service. Check the vendor advisory for confirmation and apply the official patch accordingly.