{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T06:00:38.142","vulnerabilities":[{"cve":{"id":"CVE-2026-22818","sourceIdentifier":"security-advisories@github.com","published":"2026-01-13T20:16:11.740","lastModified":"2026-01-20T16:47:51.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4."},{"lang":"es","value":"Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la versión 4.11.4, existe una falla en el middleware de verificación JWT de JWK/JWKS de Hono que permitía que el algoritmo especificado en la cabecera JWT influyera en la verificación de la firma cuando el JWK seleccionado no definía explícitamente un algoritmo. Esto podría habilitar la confusión de algoritmos JWT y, en ciertas configuraciones, permitir que se aceptaran tokens falsificados. El middleware de verificación JWT de JWK/JWKS ha sido actualizado para requerir una lista de permitidos explícita de algoritmos asimétricos al verificar tokens. El middleware ya no deriva el algoritmo de verificación de valores de cabecera JWT no confiables. Esta vulnerabilidad está corregida en la versión 4.11.4."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*","versionEndExcluding":"4.11.4","matchCriteriaId":"0D4B47C2-4F12-40CF-B9D0-51EC76A81F36"}]}]}],"references":[{"url":"https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}