CVE-2026-22818
High · 8.2Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)
CVSS
8.2
EPSS
0.1%
Published
Jan 13, 2026
CISA due date
—
The record
A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | hono | 0 | 4.11.4 |
| Chainguard | hono | 0 | 0 |
| Chainguard | langfuse-3-worker | 0 | 3.146.0-r1 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.146.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.146.0-r1 |
Related vulnerabilities
- GHSA-3vhc-576x-3qv4 Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted… Same vulnerability
- CVE-2026-54288 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects hono
- CVE-2026-54289 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects hono
- CVE-2026-54286 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects hono
- CVE-2026-54290 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects hono
- CVE-2026-54287 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects hono
- GHSA-rv63-4mwf-qqc2 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Also affects hono
- GHSA-wgpf-jwqj-8h8p hono: Lambda@Edge adapter keeps only the last value of a repeated request header… Also affects hono