Evidence · DiggingBeagle record
Hermes Agent pull request 133370: public authentication body limit
Merged maintainer patch adds pure-ASGI body limit of 64 KiB before parsing on three public authentication POST routes, covering content-length and chunked requests.
- Published
- Oct 5, 2026
- Publisher
- NousResearch/hermes-agent maintainers
- Source role
- patch commit artifact
Evidence record
Merged maintainer patch adds pure-ASGI body limit of 64 KiB before parsing on three public authentication POST routes, covering content-length and chunked requests.
Claim-level citations (1)
- supportsHermes Agent buffered anonymous authentication requests before enforcing limits: NousResearch merged PR #133370 on October 5. Its pure-ASGI middleware caps public /auth/ POST bodies at 64 KiB before normal JSON buffering, rejects excessive Content-Length immediately and counts actual bytes to cut off chunked or understated bodies; authenticated routes, uploads and WebSockets are left unchanged.
Pull request #133370: What does this PR do; Changes Made; How to Test; merge October 5