Threat Entry Updated 2026-01-20

CVE-2026-22818 - Hono Plugin

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification…

PLUGIN Hono

CVE-2026-22818

HIGH CVSS 8.2 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-20

CVE-2026-22817 - Hono Plugin

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is…

PLUGIN Hono

CVE-2026-22817

HIGH CVSS 8.2 2026-01-13

Risk Score

Open Full Technical Breakdown