CVE-2026-22817: Hono Package JWT Algorithm Confusion Vulnerability Leading to Token Forgery
Summary
CVE-2026-22817: A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. Affects hono versions < 4.11.4. Fixed in 4.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hono is a lightweight web framework designed for building efficient and scalable applications. It provides middleware for handling JSON Web Tokens (JWT) for authentication and authorization. However, a recent vulnerability has been identified in its JWT verification middleware, which could lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability arises from a flaw in Hono's JWK/JWKS JWT verification middleware, where the JWT header's 'alg' value can influence signature verification if the selected JWK does not explicitly specify an algorithm. This behavior can lead to JWT algorithm confusion, allowing attackers to forge tokens that may be accepted by the application. The impact of this vulnerability can result in authentication or authorization bypass, depending on the application's configuration and the algorithms it accepts.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.4
This is the first release that contains the fix.
npm install hono@4.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update immediately, you can implement a temporary workaround by explicitly specifying the 'alg' option in your JWT middleware configuration. Here is an example of the correct configuration:
import { jwt } from 'hono/jwt';
app.use(
'/auth/*',
jwt({
secret: 'it-is-very-secret',
alg: 'HS256' // required
})
);
Conclusion
The Hono package has a significant vulnerability (CVE-2026-22817) that can lead to JWT algorithm confusion and token forgery. It is crucial to update to the patched version (4.11.4 or later) and ensure that the 'alg' option is explicitly specified in the configuration to mitigate this risk.
See every vulnerability recorded for hono →
FAQ
CVE-2026-22817 is a vulnerability in the Hono package that allows JWT algorithm confusion, potentially leading to token forgery and authentication bypass.
If your application uses Hono's JWT middleware without explicitly specifying the 'alg' option, it may accept forged tokens, compromising security.
You can implement a temporary workaround by explicitly specifying the 'alg' option in your JWT middleware configuration.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
