CVE-2025-59139
BaseFortify
Publication date: 2025-09-12
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hono | hono | to 4.9.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Hono web application framework versions prior to 4.9.7. The flaw is in the 'bodyLimit' middleware, which is supposed to limit the size of HTTP request bodies. However, when conflicting HTTP headers are present—specifically both 'Content-Length' and 'Transfer-Encoding: chunked'—the middleware incorrectly prioritizes 'Content-Length' instead of ignoring it as required by the HTTP specification. This allows attackers to bypass the configured request body size limit by sending oversized request bodies, potentially causing the application to process much larger requests than intended.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service (DoS) risk. Attackers can send oversized request bodies that bypass the size limit, leading to excessive memory or CPU consumption on the server. This can degrade performance or cause the application to crash. The practical impact depends on the runtime and deployment environment, as many standards-compliant runtimes and reverse proxies may reject such malformed requests with a '400 Bad Request' response, mitigating the risk.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Hono to version 4.9.7 or later, where the issue with the bodyLimit middleware has been fixed to properly prioritize the Transfer-Encoding header over Content-Length as per the HTTP specification.