CVE-2026-22818
HighSummary
Hono is a web framework for JavaScript. Prior to 4.11.4, the JWK/JWKS JWT verification middleware had a flaw that allowed the algorithm from the JWT header to influence signature verification when the selected JWK did not define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.
Risk Assessment
The risk is the potential bypass of JWT signature verification, which could lead to unauthorized access or privilege escalation. The organization may be exposed to attacks using forged tokens if using Hono with JWK/JWKS.
Recommendation
Immediately upgrade Hono to version 4.11.4 or later. After upgrading, ensure the JWK/JWKS middleware configuration requires an explicit allowlist of asymmetric algorithms.
Other vulnerabilities in Hono
See all- CVE-2026-22817High
Hono is a web framework for JavaScript. Prior to version 4.11.4, the JWT middleware for JWK/JWKS verification had a flaw where the JWT header's alg value could influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.
- GHSA-frvp-7c67-39w9Medium
Path traversal vulnerability in serve-static on Windows via encoded backslash (%5C) in the request path. On Windows hosts, an encoded backslash (%5C) decodes to \, which the Windows path treats as a directory separator.
- CVE-2026-69207Medium
Hono before version 4.12.34 has a ReDoS vulnerability in the built-in CORS middleware (hono/cors). During a preflight OPTIONS request, the middleware parses the Access-Control-Request-Headers header using a regular expression with quadratic complexity, which can cause long CPU consumption and block request processing. This affects the default configuration when allowHeaders is unset or empty.
- CVE-2026-71850Medium
A vulnerability in the Hono framework from version 3.8.0 to 4.12.33 affects memo() from hono/jsx, which retains the result of a server-side render and reuses it for later renders with equal props. Request-scoped values read inside the component are not part of the comparison, potentially causing a user to receive HTML rendered for another user's request. The issue is fixed in version 4.12.34.
- CVE-2026-71849Low
Hono is a web application framework supporting any JavaScript runtime. From 4.7.0 to 4.12.33, the proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110, an intermediary must remove these headers before forwarding, but the function only removes standard hop-by-hop headers, potentially leading to disclosure of internal metadata.
- CVE-2026-71848Medium
A vulnerability in the Hono framework from version 4.12.0 to 4.12.33 affects the languageDetector middleware, which is vulnerable to algorithmic complexity denial of service when processing a crafted language tag with a large number of hyphen-separated subtags. The normalizeLanguage() function repeatedly calls parts.slice(0, i).join('-') for every possible prefix, causing quadratic processing growth. The issue is fixed in version 4.12.34.
- CVE-2026-56764Low
Hono before version 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.
- CVE-2026-56763Medium
A vulnerability in Hono before version 4.12.7 allows the __proto__ key in parseBody with the dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
- CVE-2026-59897Medium
In Hono framework versions 4.3.3 through 4.12.26, the AWS API Gateway v1 adapter incorrectly de-duplicates header values using substring comparison instead of exact match. This causes distinct repeated header values to be dropped, affecting the completeness of data processed by middleware or application logic.
- CVE-2026-59896Medium
In Hono framework versions 4.11.8 through 4.12.26, a vulnerability was found where context values are not isolated per request during server-side rendering (SSR). This allows data from another concurrent request to be used after an await statement in an async component.
Original NVD description (English source)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.