# CVE-2026-44459: hono — Fixed in 4.12.18

📦

📦 npm

Not in CISA KEV

LOW severity

# CVE-2026-44459 — hono

LOW 

CVE-2026-44459 is a low-severity (CVSS 3.8) CWE-1284 vulnerability in hono. A fix is available for hono — see the affected versions and patch details below.

Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Also known as[GHSA-hm8q-7f3q-5f36](/vulnerability/GHSA-hm8q-7f3q-5f36)

Published

May 13, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44459.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs12th percentile — riskier than 12% of all scored CVEsHighest risk

0.00%0.26%0.52%0.78%0.0%0.2%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

7Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`hono`npm

104.3Mdownloads / week

## Description

#### Summary

Improper validation of the JWT NumericDate claims `exp`, `nbf`, and `iat` in `hono/utils/jwt` allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches `verify()` — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control.

#### Details

The validation routine combined option, presence, and threshold checks in a single short-circuiting expression, so several classes of malformed values were silently skipped instead of rejected:

-   A falsy numeric value short-circuited the presence check.
-   A non-finite numeric value compared as never-after-now and never-expired.
-   A non-numeric type produced NaN comparisons that evaluated false.

This deviates from RFC 7519 §4.1.4, which defines NumericDate as a finite JSON numeric value.

#### Impact

An actor able to issue tokens accepted by the application may craft tokens whose `exp`, `nbf`, or `iat` claims silently bypass time-based enforcement. This may lead to:

-   Tokens treated as never expiring even with `exp` configured on the verifier.
-   Tokens with a future `nbf` accepted as currently valid.
-   Tokens with a future `iat` accepted as legitimately issued.

Deployments using a well-formed token issuer and protecting the signing key are not affected.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`hono` 

all versions

4.12.18`npm install hono@4.12.18`

## Affected Products

1 product · 1 configurations

Application

`hono`hono

< 4.12.18

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hono, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update hono to 4.12.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44459 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
    

## Frequently Asked Questions

\### Summary Improper validation of the JWT NumericDate claims \`exp\`, \`nbf\`, and \`iat\` in \`hono/utils/jwt\` allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches \`verify()\` — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control. ### Details The validation routine combined option, presence, and threshold checks in a single short-circuiting expression, so several classes of malformed val

O3 Security · Impact-Aware SCA

### Is CVE-2026-44459 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)