CVE-2025-62610: Hono JWT audience validation missing in middleware

CVE-2025-62610 · Severity: high · CVSS 8.1 · Published 2025-10-22

Hono is a popular web framework used to build APIs and backend services. Its JWT authentication middleware fails to validate the audience (aud) claim by default, allowing tokens issued for one service to be accepted by another service that shares the same signing keys. In a multi-service environment using a shared identity provider, an attacker can obtain a valid token for a different service and use it to access restricted endpoints, bypassing authorization controls.

Technologies: Hono, hono (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2025-62610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62610 being exploited in the wild.
How severe is CVE-2025-62610?
High severity, with a CVSS score of 8.1, published 22 October 2025.
Which products and versions are affected?
hono (npm) SEMVER:introduced=1.1.0,fixed=4.10.2.
Is there a fix for CVE-2025-62610?
Yes. hono (npm): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62610 attacked?
It is attacked over the network.
Am I affected by CVE-2025-62610?
Check whether you run Hono or hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • hono (npm): upgrade to 4.10.2 or later
    npm install hono@4.10.2

Technical details

The vulnerability is an improper authorization issue (CWE-285) stemming from missing JWT audience (aud) claim validation in Hono's JWT middleware. The middleware's verifyOptions enumerate iss, nbf, iat, and exp claims but lack aud support, violating RFC 7519 §4.1.3 which requires tokens to be rejected if the aud claim does not match the intended recipient. Attack vector is network-based with no privileges required but requires user interaction (e.g., a victim logging in via a shared OAuth provider). An attacker can obtain a valid token intended for Service B and use it to access Service A if both share signing keys. The vulnerability affects versions from 1.1.0 through 4.10.1; it was patched in version 4.10.2 by adding a verification.aud configuration option.

Affected products

  • Hono Hono 1.1.0 through 4.10.1

Identifiers

  • CVE-2025-62610
  • GHSA-m732-5p4w-x69g

Timeline

  • 2025-10-22: disclosed: GHSA advisory published
  • 2025-10-22: patched: Fixed in version 4.10.2 with verification.aud option

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.