JWT Verification Flaw in Hono Framework Affects Security of JavaScript Applications

CVE-2026-22817

What is CVE-2026-22817?

A critical vulnerability was found in the Hono framework's implementation of JWT verification. Prior to version 4.11.4, the middleware allowed the 'alg' value in the JWT header to compromise signature verification. If the chosen JWK did not clearly define an algorithm, this could lead to potential JWT algorithm confusion, enabling attackers to craft forged tokens that may bypass security measures. In response to this vulnerability, an update to version 4.11.4 ensures that the 'alg' option must be specified explicitly, effectively mitigating the risk associated with untrusted JWT header values.

References