{"id":"EUVD-2026-30038","enisaUuid":"4f35f739-03f9-3e6b-9548-02cdfbee5dee","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.","datePublished":"May 13, 2026, 3:02:23 PM","dateUpdated":"Jun 23, 2026, 3:52:56 PM","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36\n","aliases":"CVE-2026-44459\nGHSA-hm8q-7f3q-5f36\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"25ab9785-6562-3f4f-b26d-77d2f3fa0852","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.18"}],"enisaIdVendor":[{"id":"2f3c2eab-47e5-3659-9cfe-3fdb0e2edc65","vendor":{"name":"honojs"}}],"enisaIdVulnerability":[{"id":"11c2bdd7-2d75-3321-99ee-d73a01884885","vulnerability":{"id":"GHSA-hm8q-7f3q-5f36","description":"Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()","datePublished":"May 9, 2026, 12:45:19 AM","dateUpdated":"May 14, 2026, 8:35:44 PM","baseScore":0.0,"references":"https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44459\nhttps://github.com/honojs/hono\n","enisa_id":"EUVD-2026-30038\n","aliases":"GHSA-hm8q-7f3q-5f36\nCVE-2026-44459\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"70cd3b49-cae3-3178-a638-4341db9b7941","vulnerability":{"id":"CVE-2026-44459","description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.","datePublished":"May 13, 2026, 3:02:23 PM","dateUpdated":"Jun 23, 2026, 3:52:56 PM","status":"PUBLISHED","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36\n","enisa_id":"EUVD-2026-30038\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"779f2632-9453-3c98-9c66-1ffb6c6d5611","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"\u003c 4.12.18"}],"vulnerabilityVendor":[{"id":"f90dd779-120e-32ce-8fd9-4e7a844a1b82","vendor":{"name":"honojs"}}]}}],"enisaIdAdvisory":[]}