What’s Vulnerable › Vulnerabilities
CVE-2026-47673: Hono: JWT middleware accepts any Authorization scheme, not only Bearer
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-28 · updated 2026-10-14
- Weakness: CWE-285
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is fixed in 4.12.21.
Affected products
- honojs hono: before 4.12.21 — fixed in 4.12.21
How to fix
Upgrade to a fixed version: honojs hono 4.12.21. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-47673 or the next vulnerability affects your stack