{"id":"EUVD-2026-2017","revision":null,"records":[{"revision":"6114df4e144a4f6292612e684f1c9f59","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-22818","aliases":[],"title":"JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks \"alg\" (untrusted header.alg fallback)","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.","state":0,"publishedAt":"2026-01-13T19:49:52.042+00:00","modifiedAt":"2026-01-15T15:29:39.849+00:00","affected":[{"ecosystem":"Vendor product","name":"hono","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"honojs\",\n                    \"product\": \"hono\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.11.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4","https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22818","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-22818","identifiers":["CVE-2026-22818"]},"retained":false,"historicalAffected":[]},{"revision":"243ddd537024450bba9d4d8c587d1437","observedAt":"2026-11-15T07:35:36.148+00:00","statement":{"source":"euvd","id":"EUVD-2026-2017","aliases":["CVE-2026-22818","GHSA-3vhc-576x-3qv4"],"title":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature v…","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":null}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4","https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2017","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jan 13, 2026, 7:49:52 PM","dateUpdated":"Jan 15, 2026, 3:29:39 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-0328","title":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-13491","CVE-2025-61727","CVE-2025-61729","CVE-2026-0621","CVE-2026-21226","CVE-2026-22817","CVE-2026-22818"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-2017","identifiers":["EUVD-2026-2017","CVE-2026-22818","GHSA-3vhc-576x-3qv4"]},"retained":false,"historicalAffected":[]},{"revision":"dcb990fff62c4cca957158475c03dc38","observedAt":"2026-10-25T05:17:36.726+00:00","statement":{"source":"nvd","id":"CVE-2026-22818","aliases":[],"title":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature v…","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.","state":0,"publishedAt":"2026-01-13T20:16:11.74+00:00","modifiedAt":"2026-06-17T10:20:29.07+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134","https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22818","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-347"],"productCriteria":["cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-01-13T20:16:11.740","lastModified":"2026-06-17T10:20:29.070"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-22818","identifiers":["CVE-2026-22818"]},"retained":false,"historicalAffected":[]},{"revision":"e52da70fab984de58f99c32cfa0aff2d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-3vhc-576x-3qv4","aliases":["CVE-2026-22818"],"title":"Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)","description":"## Summary\n\nA flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.\n\n## Details\n\nWhen verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s `alg` field if present. If the JWK did not specify an algorithm, the middleware fell back to using the `alg` value provided in the unverified JWT header.\n\nBecause the `alg` field in a JWK is optional and commonly omitted in real-world JWKS configurations, this behavior could allow an attacker to influence which algorithm is used for verification. In some environments, this may result in authentication or authorization bypass through crafted JWTs.\n\nThe practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used to make authorization decisions.\n\n## Impact\n\nIn affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially leading to authentication or authorization bypass.\n\nApplications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.\n\n## Resolution\n\nUpdate to the latest patched release.\n\n**Breaking change:**\n\nThe JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values.\n\nInstead, callers must explicitly specify which asymmetric algorithms are permitted, and only tokens signed with those algorithms will be accepted. This prevents JWT algorithm confusion by ensuring that algorithm selection is fully controlled by application\nconfiguration.\n\nAs part of this fix, the `alg` option is now required when using the JWK/JWKS middleware, and symmetric (HS*) algorithms are no longer accepted in this context.\n\n### Before (vulnerable configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n  '/auth/*',\n  jwk({\n    jwks_uri: 'https://example.com/.well-known/jwks.json',\n    // alg was optional\n  })\n)\n```\n\n### After (patched configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n  '/auth/*',\n  jwk({\n    jwks_uri: 'https://example.com/.well-known/jwks.json',\n    alg: ['RS256'], // required: explicit asymmetric algorithm allowlist\n  })\n)\n```","state":0,"publishedAt":"2026-01-13T21:52:03+00:00","modifiedAt":"2026-09-10T03:50:58.8780829+00:00","affected":[{"ecosystem":"npm","name":"hono","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.11.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4","https://nvd.nist.gov/vuln/detail/CVE-2026-22818","https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134","https://github.com/honojs/hono"],"sourceUrl":"https://github.com/advisories/GHSA-3vhc-576x-3qv4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3vhc-576x-3qv4","identifiers":["GHSA-3vhc-576x-3qv4","CVE-2026-22818"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T23:06:17.8993558+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T23:06:17.8993558+00:00","lastSuccessAt":"2026-11-15T23:06:18.1032742+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:18.1032749+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-39ebbce2db83696403d232c43a03ba55a47d1e19101fb621bbb1e57f01bae099","complete":true,"records":425869,"lastAttemptAt":"2026-11-15T23:06:17.3240958+00:00","lastSuccessAt":"2026-11-15T23:06:17.2976675+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.3240958+00:00","snapshotPublishedAt":"2026-11-15T22:27:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1f00a6164e4d4eb5b570181d2d48c31d","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T23:16:09.5280366+00:00","lastSuccessAt":"2026-11-15T23:16:09.517+00:00","error":"50 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T23:16:09.517+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13688,"expectedIdentifiers":13874,"failedIdentifiers":50},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T23:06:17.8993558+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T23:06:17.8993558+00:00","lastSuccessAt":"2026-11-15T23:06:18.1046693+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:18.1046697+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-41e8388e19074c0d9ced98f4bd388802","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T23:07:00.0091971+00:00","lastSuccessAt":"2026-11-15T23:07:00.006+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:07:00.006+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T23:06:17.7078343+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.7078343+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T23:06:17.4961704+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.4961704+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T23:06:17.8235923+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.8235923+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T23:06:17.6038079+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.6038079+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}