CVE-2026-22817: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22817 is a JWT algorithm confusion vulnerability in the Hono web application framework's JWK/JWKS JWT verification middleware, allowing forged tokens to be accepted and authentication/authorization to be bypassed. It affects all Hono versions prior to 4.11.4 on Node.js and other JavaScript runtimes. The vulnerability was published on January 13, 2026, by GitHub (assigned by GitHub_M). The CNA (GitHub) assigned a CVSS v3.1 score of 8.2 (High), while NVD assessed it at 6.5 (Medium) (Github Advisory, Hono Security Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). When verifying JWTs using JWKs or a JWKS endpoint, Hono's middleware selected the verification algorithm based on the JWK's alg field if present, but fell back to the alg value from the unverified JWT header when the JWK did not specify an algorithm — a common real-world scenario since the alg field in a JWK is optional. This allowed an attacker to craft a JWT with an attacker-controlled alg header value (e.g., substituting HS256 for RS256), causing the server to use a weaker or different algorithm for verification. The fix removes the HS256 default fallback in the verify() function, makes the alg parameter required, and adds an explicit check that header.alg matches options.alg before proceeding with verification (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to forge JWT tokens with arbitrary attacker-controlled claims, bypassing authentication and authorization mechanisms in affected Hono applications. The primary impact is high integrity loss (unauthorized actions, privilege escalation, impersonation) and low confidentiality loss (access to protected resources). Applications not using the JWK/JWKS middleware, not relying on JWT-based authentication, or explicitly restricting allowed algorithms are not affected (Github Advisory, Hono Security Advisory).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of reporting (Github Advisory). The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available. The attack requires no authentication, no user interaction, and is remotely exploitable over the network, making it low-complexity if a suitable target configuration is identified.

1. Reconnaissance: Identify Hono-based web applications using JWT authentication with JWK/JWKS verification and running versions prior to 4.11.4. This can be done by inspecting HTTP response headers, JavaScript bundle analysis, or open-source intelligence.
2. Identify target endpoint: Locate a protected API endpoint that uses Hono's JWT middleware for authentication (e.g., /auth/* routes).
3. Obtain or inspect a valid JWT: Capture a legitimate JWT from the application (e.g., via login) to understand the expected payload structure and claims.
4. Craft a forged JWT: Create a new JWT with attacker-controlled claims (e.g., elevated roles or a different user identity). Set the JWT header's alg field to a symmetric algorithm (e.g., HS256) even if the server uses asymmetric keys (e.g., RS256), exploiting the middleware's fallback to the header's alg value when the JWK lacks an explicit alg field.
5. Sign the forged token: Sign the crafted JWT using the chosen algorithm and an attacker-controlled secret (for HS256) or the server's public key (in a classic algorithm confusion attack where the server treats the public key as an HMAC secret).
6. Submit the forged token: Send the crafted JWT in the Authorization: Bearer <token> header to the protected endpoint.
7. Achieve authentication bypass: If the server is vulnerable, it accepts the forged token and grants access based on the attacker-controlled claims, resulting in authentication or authorization bypass (Hono Security Advisory, Patch Commit).

• Network: Unusual or repeated requests to JWT-protected endpoints (/auth/* or similar) with Authorization: Bearer tokens whose header alg field differs from the expected algorithm configured on the server; requests with tokens signed using HS256 against endpoints configured for asymmetric algorithms (RS256, ES256, etc.).
• Logs: Application logs showing successful authentication events for users or roles that should not have access; JWT verification errors followed immediately by successful access (if error handling is misconfigured); access from unexpected IP addresses to privileged endpoints.
• Application Behavior: Unexpected privilege escalation or access to resources by accounts that should not have such permissions; JWT payloads containing unusual or elevated claims (e.g., admin: true, unexpected sub values) in server-side logs.

Upgrade Hono to version 4.11.4 or later, which fixes this vulnerability by requiring the alg option to be explicitly specified in the JWT middleware configuration (Github Advisory, Patch Commit). After upgrading, update all JWT middleware configurations to explicitly include the alg parameter (e.g., jwt({ secret: 'your-secret', alg: 'HS256' })); failure to do so will result in a runtime error. IBM watsonx Orchestrate with watsonx Assistant Cartridge users should refer to IBM's security bulletins for applicable patches (IBM Advisory). As a temporary workaround prior to patching, restrict JWKS configurations to only include JWKs with explicit alg fields, or implement additional server-side algorithm validation.

The vulnerability was reported by security researchers calloc134 and devanshbatham, and the advisory was published by Hono maintainer yusukebe on January 13, 2026 (Hono Security Advisory). Community discussion appeared on Mastodon and Bluesky shortly after disclosure, with TheHackerWire and undercode accounts sharing the advisory. Several technical blog posts and dev.to articles were subsequently published discussing JWT algorithm confusion attacks in the context of this CVE and related 2026 vulnerabilities (Github Advisory).