CVE-2025-62610: 
JavaScript vulnerability analysis and mitigation

Hono is a Web application framework that provides support for any JavaScript runtime. A vulnerability (CVE-2025-62610) was discovered in versions 1.1.0 to before 4.10.2, where Hono's JWT Auth Middleware lacked a built-in aud (Audience) verification option. This could lead to confused-deputy/token-mix-up issues, allowing an API to accept valid tokens intended for different audiences when multiple services share the same issuer/keys. The vulnerability was disclosed on October 21, 2025, and has been patched in version 4.10.2 (GitHub Advisory).

The vulnerability stems from the JWT authentication middleware's failure to validate the aud (Audience) claim by default. The middleware's verifyOptions only enumerated iss, nbf, iat, and exp, without including an aud option. This omission violates RFC 7519 §4.1.3, which requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (GitHub Advisory).

The vulnerability can lead to cross-service access where tokens intended for one service (Service B) could be accepted by another service (Service A). This particularly affects deployments with a single IdP/JWKS and shared keys across multiple services. For example, in implementations using Google Identity (OIDC), where the issuer is shared across applications, an attacker could potentially use a token obtained from one service to access another service with the victim's privileges (GitHub Advisory).

The issue has been patched in version 4.10.2. Users should upgrade to this version and enable RFC 7519-compliant audience validation using the new verification.aud option. The recommended secure configuration includes explicitly setting the audience verification in the JWT middleware configuration. For example: jwt({ secret: 'my-secret', verification: { aud: 'service-a' } }) (GitHub Advisory).