Improper Validation of Specified Quantity in Input Affecting hono package, versions >=1.1.0 <4.12.18

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input through the verify function in the JWT component. An attacker can supply a signed token with malformed nbf, exp, or iat claims, including non-numeric values or non-finite numbers such as 1e400, to have the claims skipped during validation and use a token that should be rejected. This lets an attacker present tokens with invalid time-based claims and gain unauthorized access to protected JWT-backed functionality.

Note: This is only exploitable if the attacker can issue tokens accepted by the application or has control over the signing key.

• GitHub Commit
• Maintainer's Advisory