CVE-2026-22817
Reported by github_m · Published January 13, 2026
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| langfuse-3 | Chainguard | 3.146.0-r1 |
| hono | hono | 4.11.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| honojs | hono | < 4.11.4 |
| honojs | hono | 0 |
Timeline
- Jan 13, 2026 CVE Published
- Jan 13, 2026 PoC Published (6 in total, the first dated here)
- Jan 14, 2026 EPSS Score (30 in total, the first dated here)
- Mar 9, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-22817
vulnetix vdb fixes CVE-2026-22817Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-22817/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4 x_refsource_CONFIRM
- https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f x_refsource_MISC