CVE-2026-22818: Hono Package Suffers from JWT Algorithm Confusion Vulnerability
Summary
CVE-2026-22818: A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. Affects hono versions < 4.11.4. Fixed in 4.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hono is a lightweight web framework designed for building web applications and APIs. It provides middleware for handling JSON Web Tokens (JWT) and JSON Web Key Sets (JWKS), allowing developers to implement authentication and authorization in their applications. However, a flaw in its JWK/JWKS JWT verification middleware has been identified, which could lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability arises from a flaw in Hono's JWK/JWKS JWT verification middleware, where the algorithm specified in the JWT header can influence signature verification if the selected JWK does not explicitly define an algorithm. This behavior allows an attacker to exploit the absence of an 'alg' field in the JWK, potentially leading to JWT algorithm confusion. As a result, forged tokens may be accepted, allowing unauthorized access to applications. The impact of this vulnerability is contingent on the application's configuration, particularly regarding accepted algorithms and how JWTs are utilized for authorization decisions.
How To Fix
Latest published version: 4.13.13 as of 23 Oct 2026
npm install hono@4.13.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.4
This is the first release that contains the fix.
npm install hono@4.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, you can implement the following workaround by explicitly specifying the allowed asymmetric algorithms in your middleware configuration:
import { jwk } from 'hono/jwk'
app.use(
'/auth/*',
jwk({
jwks_uri: 'https://example.com/.well-known/jwks.json',
alg: ['RS256'], // required: explicit asymmetric algorithm allowlist
})
)
Conclusion
The Hono package has a significant vulnerability (CVE-2026-22818) that can lead to JWT algorithm confusion, potentially allowing unauthorized access. It is crucial to update to the patched version (4.11.4 or later) or implement the specified workaround to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for hono →
FAQ
The vulnerability allows an attacker to influence the JWT verification algorithm due to the absence of an 'alg' field in the JWK, potentially leading to unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any installation.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
If you cannot update immediately, implement the provided workaround to specify allowed algorithms in your middleware configuration.
Applications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for hono.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
