Executive brief
Hono is a web framework used for building applications. A vulnerability in its security token validation allows specially crafted login tokens to bypass expiration and timing checks. This could allow an attacker who already has the ability to issue tokens to create ones that never expire or are valid before they should be, potentially leading to unauthorized long-term access.
Technical details
The JWT verification utility in Hono (`hono/utils/jwt`) fails to properly validate `NumericDate` claims including `exp` (expiration), `nbf` (not before), and `iat` (issued at). The validation logic used short-circuiting expressions that allowed malformed values—such as non-finite numbers, non-numeric types, or falsy values—to be skipped rather than rejected. This deviates from RFC 7519 and allows tokens to be treated as never-expiring or valid in the future. Exploitation requires the attacker to have control over the token issuance process or the signing key. The issue is fixed in version 4.12.18.
Affected products
- honojs hono < 4.12.18
Timeline
- 2026-05-06: disclosed: Vulnerability reported to maintainers
- 2026-05-09: advisory: GitHub Advisory published
- 2026-05-13: other: NVD published date