Medium severity4.8NVD Advisory· Published May 28, 2026· Updated May 29, 2026
CVE-2026-47673
CVE-2026-47673
Description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is fixed in 4.12.21.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
hononpm | < 4.12.21 | 4.12.21 |
Affected products
10- osv-coords7 versionspkg:apk/chainguard/honopkg:apk/chainguard/hono-adapter-mqttpkg:apk/chainguard/hono-clipkg:apk/chainguard/hono-compatpkg:apk/chainguard/hono-service-authpkg:apk/chainguard/hono-service-command-routerpkg:apk/chainguard/hono-service-device-registry-jdbc
< 0+ 6 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-f577-qrjj-4474ghsaADVISORY
- github.com/honojs/hono/security/advisories/GHSA-f577-qrjj-4474nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-47673ghsaADVISORY
- github.com/honojs/hono/commit/5463db2735476959b8af67756f4e513f4fe19115ghsaWEB
- github.com/honojs/hono/releases/tag/v4.12.21ghsaWEB
News mentions
1- Hono 4.12.21: Four Medium-Severity CVEs Disclosed in a Single AdvisoryVypr Intelligence · May 28, 2026