npm/hono CVE-2026-22818: high 8.2, EPSS 0.14%
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)
Action: Upgrade hono to 4.11.4 or later.
npm i hono@4.11.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.11.4 | - |
Fixed versions
| 4.11.4 |
Sources
- osv: GHSA-3vhc-576x-3qv4
- https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4
- https://nvd.nist.gov/vuln/detail/CVE-2026-22818
- https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134
- https://github.com/honojs/hono
CVE-2026-22818 · published · modified · JSON