1 matches found
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Summary bodyLimit does not reliably enforce maxSize for requests without a usable Content-Length e.g. Transfer-Encoding: chunked. Oversized requests can reach handlers and return 200 instead of 413. Details For chunked / unknown-length requests, bodyLimit wraps the body in a stream that counts...
6.5CVSS5.8AI score0.00219EPSS
SaveExploits0References3Affected Software1
20