CVE-2026-44459

Improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify(), typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control.

Details

The validation routine combined option, presence, and threshold checks in a single short-circuiting expression, so several classes of malformed values were silently skipped instead of rejected:

• A falsy numeric value short-circuited the presence check.
• A non-finite numeric value compared as never-after-now and never-expired.
• A non-numeric type produced NaN comparisons that evaluated false.

This deviates from RFC 7519 §4.1.4, which defines NumericDate as a finite JSON numeric value.

An actor able to issue tokens accepted by the application may craft tokens whose exp, nbf, or iat claims silently bypass time-based enforcement. This may lead to:

• Tokens treated as never expiring even with exp configured on the verifier.
• Tokens with a future nbf accepted as currently valid.
• Tokens with a future iat accepted as legitimately issued.

Deployments using a well-formed token issuer and protecting the signing key are not affected.

CVE-2026-44459 has a CVSS score of 3.8 (Low). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.12.18); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-44459? CVE-2026-44459 is a low-severity security vulnerability in hono (npm), affecting versions < 4.12.18. It is fixed in 4.12.18.
2. How severe is CVE-2026-44459? CVE-2026-44459 has a CVSS score of 3.8 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of hono are affected by CVE-2026-44459? hono (npm) versions < 4.12.18 is affected.
4. Is there a fix for CVE-2026-44459? Yes. CVE-2026-44459 is fixed in 4.12.18. Upgrade to this version or later.
5. Is CVE-2026-44459 exploitable, and should I be worried? Whether CVE-2026-44459 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-44459 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-44459? Upgrade hono to 4.12.18 or later.