CVE-2026-22817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22817", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.289Z", "datePublished": "2026-01-13T19:49:55.316Z", "dateUpdated": "2026-01-14T19:12:35.457Z"}, "containers": {"cna": {"title": "JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4"}, {"name": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f"}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"version": "< 4.11.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T19:49:55.316Z"}, "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}], "source": {"advisory": "GHSA-f67f-6cw9-8mq4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T19:12:27.378678Z", "id": "CVE-2026-22817", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:12:35.457Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22817", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T19:12:27.378678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:12:32.381Z"}}], "cna": {"title": "JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass", "source": {"advisory": "GHSA-f67f-6cw9-8mq4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.11.4"}]}], "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4", "name": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f", "name": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T19:49:55.316Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22817", "state": "PUBLISHED", "dateUpdated": "2026-01-14T19:12:35.457Z", "dateReserved": "2026-01-09T22:50:10.289Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-13T19:49:55.316Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hono", "vendor": "honojs", "versions": [{"status": "affected", "version": "< 4.11.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "0D4B47C2-4F12-40CF-B9D0-51EC76A81F36", "versionEndExcluding": "4.11.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.11.4, existe una falla en el middleware de verificaci\u00f3n de JWT JWK/JWKS de Hono que permit\u00eda que el valor 'alg' del encabezado JWT influyera en la verificaci\u00f3n de la firma cuando el JWK seleccionado no especificaba expl\u00edcitamente un algoritmo. Esto podr\u00eda habilitar la confusi\u00f3n de algoritmos JWT y, en ciertas configuraciones, permitir que se aceptaran tokens falsificados. Como parte de esta correcci\u00f3n, el middleware JWT ahora requiere que la opci\u00f3n 'alg' se especifique expl\u00edcitamente. Esto previene la confusi\u00f3n de algoritmos asegurando que el algoritmo de verificaci\u00f3n no se derive de valores de encabezado JWT no confiables. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.11.4."}], "id": "CVE-2026-22817", "lastModified": "2026-06-17T10:20:28.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22817", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T19:12:27.378678Z", "version": "2.0.3"}}]}, "published": "2026-01-13T20:16:11.570", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:32:02.463567+00:00", "value": {"mitigation_remediation": ["Upgrade Hono to version 4.11.4 or later, which removes the algorithm confusion flaw.", "When configuring the JWT middleware, explicitly set the \u2018alg\u2019 option to the desired verification algorithm to prevent header\u2011controlled changes.", "If an upgrade cannot occur immediately, disable the JWT middleware for critical routes or implement an additional server\u2011side check that rejects tokens whose header algorithm does not match the expected value."], "summary": {"action": "Immediate Patch", "impact": "JWT Algorithm Confusion and Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The issue affects installations of the Hono framework, specifically versions earlier than 4.11.4. Developers using Hono for serverless or Node.js applications that employ the provided JWT middleware without explicitly specifying the algorithm in the options are vulnerable. The CVE identifiers point to all variants of Hono, including the generic Node.js distribution referenced by the CPE.", "description_and_impact": "The vulnerability lies in Hono\u2019s JWT verification middleware, which previously allowed the \u2018alg\u2019 value in a token\u2019s header to dictate the algorithm used when the selected JSON Web Key did not declare an explicitly supported algorithm. This behavior enables attackers to forge a JSON Web Token that will be accepted as valid, effectively allowing them to bypass authentication controls that rely on correctly signed tokens. The flaw maps to CWE\u2011347, representing an algorithmic confusion that lets untrusted header values influence signature validation.", "risk_and_exploitability": "The item has a CVSS score of 8.2, indicating high impact. Attack complexity is likely low for an application that serves untrusted users, but the EPSS score is below 1\u202f%, suggesting a rare exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker can exploit it by crafting a token with a mismatched or absent algorithm field when the server\u2019s verification logic accepts it unconditionally, thereby forging a token that grants unauthorized access. Prompt remediation is advised."}}}}, "created": "2026-01-14T11:08:21.607457+00:00", "updated": "2026-04-18T06:45:23.954632+00:00", "vendors": ["hono", "hono$PRODUCT$hono"]}