CVE-2026-47673 Details
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is fixed in 4.12.21.
A vulnerability exists in the Hono web application framework's JWT and JWK middlewares, prior to version 4.12.21. These middlewares fail to ensure that the Authorization header value adheres to the Bearer scheme. As a result, any two-part header value, regardless of the scheme name, is processed for JWT verification. This flaw allows a valid JWT under a non-Bearer scheme identifier, such as Basic or Token, to be authenticated as if it were a properly formatted Bearer request. The issue arises because the middleware does not check that the first token is 'Bearer', allowing bypass of network-layer security controls that rely on scheme-specific policies.
Users can upgrade to Hono version 4.12.21 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/honojs/hono/security/advisories/GHSA-f577-qrjj-4474 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hono hono | < 4.12.21 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |