Skip to content

Commit ffaad11

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3vhc-576x-3qv4 GHSA-45hj-9x76-wp9g GHSA-f67f-6cw9-8mq4
1 parent ae92a7c commit ffaad11

File tree

3 files changed

+195
-0
lines changed

3 files changed

+195
-0
lines changed

‎advisories/github-reviewed/2026/01/GHSA-3vhc-576x-3qv4/GHSA-3vhc-576x-3qv4.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3vhc-576x-3qv4",
4+
"modified": "2026-01-13T21:52:03Z",
5+
"published": "2026-01-13T21:52:03Z",
6+
"aliases": [
7+
"CVE-2026-22818"
8+
],
9+
"summary": "Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)",
10+
"details": "## Summary\n\nA flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.\n\n## Details\n\nWhen verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s `alg` field if present. If the JWK did not specify an algorithm, the middleware fell back to using the `alg` value provided in the unverified JWT header.\n\nBecause the `alg` field in a JWK is optional and commonly omitted in real-world JWKS configurations, this behavior could allow an attacker to influence which algorithm is used for verification. In some environments, this may result in authentication or authorization bypass through crafted JWTs.\n\nThe practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used to make authorization decisions.\n\n## Impact\n\nIn affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially leading to authentication or authorization bypass.\n\nApplications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.\n\n## Resolution\n\nUpdate to the latest patched release.\n\n**Breaking change:**\n\nThe JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values.\n\nInstead, callers must explicitly specify which asymmetric algorithms are permitted, and only tokens signed with those algorithms will be accepted. This prevents JWT algorithm confusion by ensuring that algorithm selection is fully controlled by application\nconfiguration.\n\nAs part of this fix, the `alg` option is now required when using the JWK/JWKS middleware, and symmetric (HS*) algorithms are no longer accepted in this context.\n\n### Before (vulnerable configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n '/auth/*',\n jwk({\n jwks_uri: 'https://example.com/.well-known/jwks.json',\n // alg was optional\n })\n)\n```\n\n### After (patched configuration)\n\n```ts\nimport { jwk } from 'hono/jwk'\n\napp.use(\n '/auth/*',\n jwk({\n jwks_uri: 'https://example.com/.well-known/jwks.json',\n alg: ['RS256'], // required: explicit asymmetric algorithm allowlist\n })\n)\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "hono"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.11.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22818"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/honojs/hono"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-347"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-13T21:52:03Z",
63+
"nvd_published_at": "2026-01-13T20:16:11Z"
64+
}
65+
}

‎advisories/github-reviewed/2026/01/GHSA-45hj-9x76-wp9g/GHSA-45hj-9x76-wp9g.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45hj-9x76-wp9g",
4+
"modified": "2026-01-13T21:53:31Z",
5+
"published": "2026-01-13T21:53:30Z",
6+
"aliases": [
7+
"CVE-2026-22819"
8+
],
9+
"summary": "Outray has a Race Condition in the cli's webapp",
10+
"details": "### Summary\nThis vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in `https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts`\n\n### Details\n- The affected code-:\n\n```ts\n//Race condition\n const [subscription] = await db\n .select()\n .from(subscriptions)\n .where(eq(subscriptions.organizationId, organization.id));\n\n const currentPlan = subscription?.plan || \"free\";\n const planLimits = getPlanLimits(currentPlan as any);\n const subdomainLimit = planLimits.maxSubdomains;\n\n const existingSubdomains = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.organizationId, organization.id));\n\n if (existingSubdomains.length >= subdomainLimit) {\n return json(\n {\n error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n }\n\n const existing = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.subdomain, subdomain))\n .limit(1);\n\n if (existing.length > 0) {\n return json({ error: \"Subdomain already taken\" }, { status: 409 });\n }\n\n const [newSubdomain] = await db\n .insert(subdomains)\n .values({\n id: crypto.randomUUID(),\n subdomain,\n organizationId: organization.id,\n userId: session.user.id,\n })\n .returning();\n```\n\n- The first part of the code checks the user plan and determine his/her existing_domains without locking the transaction and allowing it to run.\n```ts\nconst existingSubdomains = await db\n .select()\n .from(subdomains)\n .where(eq(subdomains.organizationId, organization.id));\n```\n\n- The other part of the code checks if the desired domain is more than the limit.\n\n```ts\nif (existingSubdomains.length >= subdomainLimit) {\n return json(\n {\n error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? \"s\" : \"\"}.`,\n },\n { status: 403 },\n );\n }\n```\n\n- Finally, it inserts the subdomain also after the whole check without locking transactions.\n\n```ts\nconst [newSubdomain] = await db\n .insert(subdomains)\n .values({\n id: crypto.randomUUID(),\n subdomain,\n organizationId: organization.id,\n userId: session.user.id,\n })\n .returning();\n```\n- An attacker can exploit this by making parallel requests to the same endpoint and if the second request reads row `subdomains` before the `INSERT` statement of request one is made.It allows the attacker to act on a not yet updated row which bypasses the checks and allow the attacker to get more subdomains.For example-:\n\n```\n Parallel request 1 Parallel Request 2 \n | |\nchecks for Checks the not yet updated\navailable subdomain row and bypasses the logic checks\nand determines if it is more than limit\n | |\nInserts subdomain and calls it a day Also inserts the subdomain\n```\n- The attack focuses on exploiting the race window between reading and writing the db rows.\n\n### PoC\n\n- Intercept with Burp proxy,pass to `Repeater` and create multiple requests in a single batch with different subdomain names as seen below. Lastly, send the requests in `parallel`.\n\n<img width=\"1844\" height=\"855\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f46d5993-31bd-4b96-902a-b2de5b0518bd\" />\n\n- Result-:\n\n<img width=\"1905\" height=\"977\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4c877de2-4b55-46f4-9f1c-78590dfebefc\" />\n\n\n### Impact\nThe vulnerability provides an infiinite supply of domains to users bypassing the need for subscription",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "outray"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.1.5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/akinloluwami/outray/security/advisories/GHSA-45hj-9x76-wp9g"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/outray-tunnel/outray/commit/08c61495761349e7fd2965229c3faa8d7b1c1581"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/akinloluwami/outray"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-366"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-13T21:53:30Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/01/GHSA-f67f-6cw9-8mq4/GHSA-f67f-6cw9-8mq4.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f67f-6cw9-8mq4",
4+
"modified": "2026-01-13T21:51:45Z",
5+
"published": "2026-01-13T21:51:44Z",
6+
"aliases": [
7+
"CVE-2026-22817"
8+
],
9+
"summary": "Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass",
10+
"details": "## Summary\n\nA flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s `alg` value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable **JWT algorithm confusion** and, in certain configurations, allow forged tokens to be accepted.\n\n## Details\n\nWhen verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s `alg` field if present, but otherwise fell back to the `alg` value provided in the unverified JWT header.\n\nBecause the `alg` field in a JWK is optional and often omitted in real-world JWKS configurations, this behavior could allow an attacker to control the algorithm used for verification. In some environments, this may lead to authentication or authorization\nbypass through crafted tokens.\n\nThe practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used for authorization decisions.\n\n## Impact\n\nIn affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially resulting in authentication or authorization bypass.\n\nApplications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.\n\n## Resolution\n\nUpdate to the latest patched release.\n\n**Breaking change:**\n\nAs part of this fix, the JWT middleware now requires the `alg` option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values.\n\nApplications upgrading must update their configuration accordingly.\n\n### Before (vulnerable configuration)\n\n```ts\nimport { jwt } from 'hono/jwt'\n\napp.use(\n '/auth/*',\n jwt({\n secret: 'it-is-very-secret',\n // alg was optional\n })\n)\n```\n\n### After (patched configuration)\n\n```ts\nimport { jwt } from 'hono/jwt'\n\napp.use(\n '/auth/*',\n jwt({\n secret: 'it-is-very-secret',\n alg: 'HS256', // required\n })\n)\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "hono"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.11.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22817"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/honojs/hono"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-347"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-13T21:51:44Z",
63+
"nvd_published_at": "2026-01-13T20:16:11Z"
64+
}
65+
}

0 commit comments

Comments
 (0)