CVE-2026-44459

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.

• CWE-1284

• https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36Vendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44453h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-44454Coder allows organizations to provision remote development e…8.8
• CVE-2026-44455Hono is a Web application framework that provides support fo…6.1
• CVE-2026-44456Hono is a Web application framework that provides support fo…6.5
• CVE-2026-44457Hono is a Web application framework that provides support fo…5.3
• CVE-2026-44458Hono is a Web application framework that provides support fo…4.3
• CVE-2026-4446Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44460FileRise is a self-hosted web-based file manager with multi-…7.4
• CVE-2026-44461Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL r…8.6
• CVE-2026-44462Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …8.8
• CVE-2026-44463Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …7.8
• CVE-2026-44465Zed is a code editor. Prior to 0.227.1, Zed IDE executes arb…8.6