Resource Exhaustion Affecting trigger-dev package, versions <4.5.4-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-TRIGGERDEV-17973283
- published15 Jul 2026
- disclosed12 Sept 2025
Introduced: 12 Sep 2025
CVE-2025-59139 (opens in a new tab)How to fix?
Upgrade Minimos:latest trigger-dev to version 4.5.4-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream trigger-dev package and not the trigger-dev package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the bodyLimit middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the Content-Length header even when a Transfer-Encoding: chunked header was also included. According to the HTTP specification, Content-Length must be ignored in such cases. This discrepancy could allow oversized request bodies to bypass the configured limit. Most standards-compliant runtimes and reverse proxies may reject such malformed requests with 400 Bad Request, so the practical impact depends on the runtime and deployment environment. If body size limits are used as a safeguard against large or malicious requests, this flaw could allow attackers to send oversized request bodies. The primary risk is denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests. The implementation has been updated to align with the HTTP specification, ensuring that Transfer-Encoding takes precedence over Content-Length. The issue is fixed in Hono v4.9.7, and all users should upgrade immediately.
References
- https://www.cve.org/CVERecord?id=CVE-2025-59139
- https://github.com/advisories/GHSA-92vj-g62v-jqhh
- https://osv.dev/vulnerability/MINI-qr2c-cccf-6gw7
- https://osv.dev/vulnerability/CVE-2025-59139
- https://github.com/honojs/hono/commit/605c70560b52f13af10379f79b76717042fafe8d
- https://github.com/honojs/hono/security/advisories/GHSA-92vj-g62v-jqhh