CVE-2026-44459 Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
Improper validation of JWT time claims allows bypassing expiration checks if malformed tokens are issued or keys are compromised.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44459?
CVE-2026-44459 is a low-severity authentication bypass vulnerability in honojs hono, published on 13 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. This vulnerability is fixed in 4.12.18.
Weakness: CWE-1284
Which versions are affected by CVE-2026-44459?
2 open source packages ship an affected version, including hono. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hono npm | All versions | 4.12.18 |
hono npm | All versions | 4.12.18 |
Products include Hono Hono.
How do I fix CVE-2026-44459?
Upgrade hono to 4.12.18 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44459 being exploited?
There is no known exploitation of CVE-2026-44459 in the wild and no public exploit code.
Other vulnerabilities in honojs hono
- CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
- CVE-2026-22817 JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass
- CVE-2026-22818 JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)
- CVE-2025-62610 Hono Improperly Authorizes JWT Audience Validation
- CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability
Sources
Also known as CLEANSTART-2026-RS53138, ECHO-e215-888a-4fed, GHSA-hm8q-7f3q-5f36, MINI-2mw8-876p-rm68, MINI-5xwh-x87f-p43x, MINI-f5xw-pv69-6586 and 6 more.