Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hono | npm | < 4.12.21 | 4.12.21 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the jwt and jwk middleware functions of the Hono framework. The core issue is the failure to validate the scheme of the Authorization header. The vulnerable code would extract a token from the header regardless of the scheme used (e.g., 'Basic', 'Token', or any other word) as long as the header value consisted of two space-separated parts. It would then proceed to validate the token itself. This flaw allows an attacker with a valid JWT to bypass network-level security controls, such as WAFs or API gateways, that are configured to enforce policies based on the 'Bearer' authentication scheme. The patch rectifies this by explicitly checking if the scheme part of the header is 'bearer' (case-insensitively) and rejecting the request if it is not, thus ensuring compliance with RFC 6750.
jwksrc/middleware/jwk/jwk.ts
jwtsrc/middleware/jwt/jwt.ts