Executive brief
Hono is a web framework used to build modern web applications with JWT-based authentication. A flaw in its JWT verification middleware allowed attackers to control which cryptographic algorithm is used to validate authentication tokens by omitting the algorithm field from the signing key. In vulnerable configurations, this could enable attackers to forge authentication tokens and gain unauthorized access to protected application features or user data.
Technical details
The vulnerability is a classic JWT algorithm confusion attack (CWE-347: Improper Verification of Cryptographic Signature). When verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm from the JWK's alg field if present; if absent, it fell back to the unverified alg value in the JWT header. Since the alg field in JWK is optional and commonly omitted in real-world JWKS configurations, attackers could influence algorithm selection by crafting tokens with attacker-controlled algorithm headers. The attack requires no authentication or user interaction and is network-accessible. The fix makes the alg option required in the middleware, enforces an explicit allowlist of asymmetric algorithms, rejects symmetric algorithms (HS*), and validates that JWK alg (if present) matches the JWT header alg. The patched version is 4.11.4.
Affected products
- honojs hono < 4.11.4
Timeline
- 2026-01-13: disclosed
- 2026-01-13: patched: Version 4.11.4 released with fix
- 2026-01-13: other: GitHub Security Advisory published