SB2026072452 - Multiple vulnerabilities in hono
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-44459)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass time-based JWT claim validation.
The vulnerability exists due to improper validation of specified quantity in input in hono/utils/jwt verify() when processing JWT NumericDate claims. A remote privileged user can supply a crafted token with malformed exp, nbf, or iat values to bypass time-based JWT claim validation.
The issue only manifests when a malformed claim value reaches verify(), typically when the application issues such tokens itself or when the signing key is under the actor's control.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary CSS declarations.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the JSX server-side renderer style attribute serialization when rendering untrusted input in a JSX style object. A remote attacker can supply a crafted style object value or property name to inject arbitrary CSS declarations.
User interaction is required to load the rendered page. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout.
3) Use of cache containing sensitive information (CVE-ID: CVE-2026-44457)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of cache containing sensitive information in Cache Middleware when handling responses that declare per-user variance via Vary: Authorization or Vary: Cookie. A remote attacker can send a request to an affected user-specific endpoint to disclose sensitive information.
The issue occurs when applications rely on these Vary headers to scope user-specific responses without also marking the response as private.
Remediation
Install update from vendor's website.