CVE-2026-54288 is a vulnerability in the honojs hono web framework affecting versions prior to 4.12.25. The Body Limit Middleware trusts the Content-Length header to determine if the request body size is within limits. However, on AWS Lambda platforms (including API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge), the body is fully buffered and the adapter constructs the request using the client-declared Content-Length, which may not match the actual payload size. This discrepancy allows an attacker to declare a smaller Content-Length header while sending a larger body, bypassing the middleware's size checks. The vulnerability is addressed in hono version 4.12.25.

An attacker can bypass the body size limit enforcement by sending a request with a falsely small Content-Length header but a larger actual payload. This may lead to processing of unexpectedly large request bodies, potentially causing resource exhaustion or other issues related to handling oversized payloads. The confidentiality and integrity impact is limited (low), and availability is not affected.

A patch is available in hono version 4.12.25 that fixes this vulnerability by properly verifying the actual payload size rather than relying solely on the Content-Length header. Users should upgrade to version 4.12.25 or later. Since this is a cloud-hosted service environment (AWS Lambda), the vendor manages remediation for the cloud-hosted service; however, for self-hosted deployments, upgrading is required. No additional mitigations are specified.