CVE-2026-22817

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4.

• CWE-347

• https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1fPatch
• https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4Third Party Advisory

Published

Jan 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22810Joplin is an open source note-taking and to-do application t…7.3
• CVE-2026-22812OpenCode is an open source AI coding agent. Prior to 1.0.216…8.8
• CVE-2026-22813OpenCode is an open source AI coding agent. The markdown ren…6.1
• CVE-2026-22814@adonisjs/lucid is an SQL ORM for AdonisJS built on top of K…8.2
• CVE-2026-22815AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-22816Gradle is a build automation tool, and its native-platform t…7.4
• CVE-2026-22818Hono is a Web application framework that provides support fo…6.5
• CVE-2026-22819Outray openSource ngrok alternative. Prior to 0.1.5, this vu…3.1
• CVE-2026-2282The Slidorion plugin for WordPress is vulnerable to Stored C…4.4
• CVE-2026-22820Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTO…3.7
• CVE-2026-22821mreporting is the more reporting GLPI plugin. Prior to 1.9.4…6.5
• CVE-2026-22822External Secrets Operator reads information from a third-par…8.8