PT-2026-2799 · Hono · Hono

Calloc134 + 1 · Published 2026-01-13 · Updated 2026-01-15 · CVE-2026-22818

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.4

Description Hono is a Web application framework supporting various JavaScript runtimes. A flaw exists in the JWK/JWKS JWT verification middleware where the algorithm specified in the JWT header could influence signature verification when the selected JWK did not explicitly define an algorithm. This could lead to JWT algorithm confusion, potentially allowing forged tokens to be accepted. The middleware has been updated to require an explicit allowlist of asymmetric algorithms for token verification, preventing the derivation of the verification algorithm from untrusted JWT header values.

Recommendations Update to Hono version 4.11.4 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-22818

GHSA-3VHC-576X-3QV4

Affected Products

Hono

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22818.json · Exploit
• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134 · Patch
• https://osv.dev/vulnerability/GHSA-3vhc-576x-3qv4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22818 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22818 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4 · Note
• https://twitter.com/VulmonFeeds/status/2011720792090738922 · Twitter Post
• https://twitter.com/CVEnew/status/2011181476172480515 · Twitter Post
• https://twitter.com/_cvereports/status/2011302950975459343 · Twitter Post