PT-2025-37316 · Hono · Hono

Imenyoo2 + 1 · Published 2025-09-12 · Updated 2025-09-17 · CVE-2025-59139

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Hono versions prior to 4.9.7

Description: Hono is a Web application framework that provides support for any JavaScript runtime. A flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the Content-Length header even when a Transfer-Encoding: chunked header was also included, which is a discrepancy with the HTTP specification. This could allow oversized request bodies to bypass the configured limit, potentially leading to denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests.

Recommendations: Upgrade to Hono version 4.9.7 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2025-59139

GHSA-92VJ-G62V-JQHH

Affected Products

Hono

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59139.json · Exploit
• https://github.com/honojs/hono/commit/605c70560b52f13af10379f79b76717042fafe8d · Patch
• https://github.com/honojs/hono/security/advisories/GHSA-92vj-g62v-jqhh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-92vj-g62v-jqhh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59139 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59139 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://twitter.com/VulmonFeeds/status/1966513656050413755 · Twitter Post
• https://twitter.com/CVEnew/status/1966494453515857945 · Twitter Post
• https://t.me/cveNotify/135732 · Telegram Post
• https://twitter.com/pHo9UBenaA/status/1968122876709704076 · Twitter Post
• https://t.me/CVEtracker/32376 · Telegram Post