8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22818

CVE-2026-22818: JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22818

CVE-2026-22818:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.11.4	4.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a JWT algorithm confusion issue where the verification logic would trust the alg field from the unverified JWT header if the corresponding JSON Web Key (JWK) did not specify an algorithm. The analysis of the patch commit 190f6e28e2ca85ce3d1f2f54db1310f5f3eab134 confirms this.

The core of the flaw was in the verifyWithJwks function in src/utils/jwt/jwt.ts. The line alg: (matchingKey.alg as SignatureAlgorithm) || header.alg, demonstrates that the function would use the header.alg as a fallback, which is controlled by the attacker. This allowed an attacker to dictate the verification algorithm.

The patch addresses this by introducing a mandatory alg parameter in the public-facing jwk middleware (src/middleware/jwk/jwk.ts), which specifies an allowlist of asymmetric algorithms. This list is then passed to verifyWithJwks. The updated verifyWithJwks function now rejects symmetric algorithms outright and validates the JWT's algorithm against the provided allowlist, removing the dangerous fallback behavior.

Two functions are identified as vulnerable:

verifyWithJwks: Contains the flawed logic of trusting the JWT header's alg parameter.
jwk: The middleware entry point that uses verifyWithJwks without enforcing any algorithm restrictions, thus exposing the vulnerability.

Both functions would be present in a runtime profile or stack trace when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.