CVE-2026-44459

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Hono es un framework de aplicación web que proporciona soporte para cualquier tiempo de ejecución de JavaScript. Antes de la 4.12.18, la validación indebida de las reclamaciones NumericDate de JWT exp, nbf e iat en hono/utils/jwt permite que los tokens con valores de reclamación que no cumplen con la especificación omitan silenciosamente las comprobaciones basadas en el tiempo. Este problema no es explotable por un atacante anónimo; solo se manifiesta cuando un valor de reclamación malformado llega a verify() - típicamente cuando la propia aplicación emite dichos tokens, o cuando la clave de firma está de cualquier otra forma bajo el control del atacante. Esta vulnerabilidad está corregida en la 4.12.18.

Information

Published : 2026-05-13 16:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44459

Mitre link : CVE-2026-44459

CVE.ORG link : CVE-2026-44459

JSON object : View

Products Affected

hono

hono

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-44459", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44459", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:36:22.194803Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.12.18"}]}]}], "published": "2026-05-13T16:16:57.970", "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier tiempo de ejecuci\u00f3n de JavaScript. Antes de la 4.12.18, la validaci\u00f3n indebida de las reclamaciones NumericDate de JWT exp, nbf e iat en hono/utils/jwt permite que los tokens con valores de reclamaci\u00f3n que no cumplen con la especificaci\u00f3n omitan silenciosamente las comprobaciones basadas en el tiempo. Este problema no es explotable por un atacante an\u00f3nimo; solo se manifiesta cuando un valor de reclamaci\u00f3n malformado llega a verify() - t\u00edpicamente cuando la propia aplicaci\u00f3n emite dichos tokens, o cuando la clave de firma est\u00e1 de cualquier otra forma bajo el control del atacante. Esta vulnerabilidad est\u00e1 corregida en la 4.12.18."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5AB1A6FC-8475-4A23-9E63-46F3E6C5D264", "versionEndExcluding": "4.12.18"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}