PT-2026-2798 · Hono · Hono

Calloc134 + 1 · Published 2026-01-13 · Updated 2026-01-14 · CVE-2026-22817

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.4

Description Hono is a Web application framework supporting various JavaScript runtimes. A flaw exists in the JWT verification middleware when using JWK/JWKS, where the alg value in the JWT header could influence signature verification even if the selected JWK did not explicitly define an algorithm. This could lead to JWT algorithm confusion, potentially allowing forged tokens to be accepted. The fix involves requiring the alg option to be explicitly specified in the JWT middleware, preventing the use of untrusted JWT header values to determine the verification algorithm.

Recommendations Update to Hono version 4.11.4 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-22817

GHSA-F67F-6CW9-8MQ4

Affected Products

Hono

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22817.json · Exploit
• https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22817 · Security Note
• https://osv.dev/vulnerability/GHSA-f67f-6cw9-8mq4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22817 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4 · Note
• https://twitter.com/_cvereports/status/2011229397349478602 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2011203848799731770 · Twitter Post
• https://twitter.com/CVEnew/status/2011181475023163846 · Twitter Post
• https://twitter.com/_cvereports/status/2011229479620780109 · Twitter Post