Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. hono
  4. ›
  5. CVE-2026-44459

CVE-2026-44459: Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

May 9, 2026 (updated May 14, 2026)

Improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control.

References

  • github.com/advisories/GHSA-hm8q-7f3q-5f36
  • github.com/honojs/hono/security/advisories/GHSA-hm8q-7f3q-5f36
  • nvd.nist.gov/vuln/detail/CVE-2026-44459

Code Behaviors & Features

Detect and mitigate CVE-2026-44459 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 4.12.18

Fixed versions

  • 4.12.18

Solution

Upgrade to version 4.12.18 or above.

Impact 3.8 LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-1284: Improper Validation of Specified Quantity in Input

Source file

npm/hono/CVE-2026-44459.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 06 Jun 2026 00:17:58 +0000.