CVE-2026-22818 Details

A vulnerability in the Hono web application framework's JWK/JWKS JWT verification middleware, prior to version 4.11.4, allowed the algorithm specified in the JWT header to influence signature verification. This issue arose when the selected JWK did not explicitly define an algorithm, enabling JWT algorithm confusion and, in certain configurations, the acceptance of forged tokens. The vulnerability has been addressed by requiring an explicit allowlist of asymmetric algorithms for verification, preventing the middleware from relying on untrusted JWT header values.

Update to Hono version 4.11.4 or later. When using the JWK/JWKS middleware, specify an allowlist of allowed asymmetric algorithms. The 'alg' option is now required and should include only the algorithms that are explicitly permitted for verification.