JWT Algorithm Confusion in Hono Web Framework by Hono

CVE-2026-22818

What is CVE-2026-22818?

The Hono Web Application Framework contained a vulnerability in its JWK/JWKS JWT verification middleware prior to version 4.11.4. This flaw allowed the algorithm specified in the JWT header to improperly influence signature verification, particularly when the selected JWK did not explicitly define an algorithm. This scenario resulted in potential JWT algorithm confusion, which could enable the acceptance of forged tokens under certain configurations. The vulnerability has been addressed in version 4.11.4, which now mandates an explicit allowlist of asymmetric algorithms for token verification, eliminating reliance on untrusted JWT header values.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References