starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-25 13:55:59 +03:00

[PR #2390] [MERGED] fix: security CVE-2026-22817 CVE-2026-22818 #2269

New issue

Closed

opened 2026-02-26 20:33:10 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 20:33:10 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/documenso/documenso/pull/2390
Author: @tedliang
Created: 1/15/2026
Status: ✅ Merged
Merged: 1/15/2026
Merged by: @Mythie

Base: main ← Head: fix/CVE-2026-22818

📝 Commits (1)

d45267d fix: security CVE-2026-22817 CVE-2026-22818

📊 Changes

3 files changed (+7 additions, -7 deletions)

View changed files

📝 apps/remix/package.json (+1 -1)
📝 package-lock.json (+5 -5)
📝 packages/auth/package.json (+1 -1)

📄 Description

Description

fix CVE-2026-22817 and CVE-2026-22818

# npm audit report

hono  <=4.11.3
Severity: high
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) - https://github.com/advisories/GHSA-3vhc-576x-3qv4
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass - https://github.com/advisories/GHSA-f67f-6cw9-8mq4
fix available via `npm audit fix --force`
Will install hono@4.11.4, which is outside the stated dependency range
node_modules/hono

1 high severity vulnerability

To address all issues, run:
  npm audit fix --force

N/A

Changes Made

Upgrade Hono

Testing Performed

Tested on Chrome

Checklist

I have tested these changes locally and they work as expected.
I have added/updated tests that prove the effectiveness of these changes.
I have updated the documentation to reflect these changes, if applicable.
I have followed the project's coding style guidelines.
I have addressed the code review feedback from the previous submission, if applicable.

Additional Notes

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/documenso/documenso/pull/2390 **Author:** [@tedliang](https://github.com/tedliang) **Created:** 1/15/2026 **Status:** ✅ Merged **Merged:** 1/15/2026 **Merged by:** [@Mythie](https://github.com/Mythie) **Base:** `main` ← **Head:** `fix/CVE-2026-22818` --- ### 📝 Commits (1) - [`d45267d`](https://github.com/documenso/documenso/commit/d45267d99b29a7d5c8e6d82286914b51ebd9e9c8) fix: security CVE-2026-22817 CVE-2026-22818 ### 📊 Changes **3 files changed** (+7 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `apps/remix/package.json` (+1 -1) 📝 `package-lock.json` (+5 -5) 📝 `packages/auth/package.json` (+1 -1) </details> ### 📄 Description ## Description fix CVE-2026-22817 and CVE-2026-22818 ``` # npm audit report hono <=4.11.3 Severity: high Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) - https://github.com/advisories/GHSA-3vhc-576x-3qv4 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass - https://github.com/advisories/GHSA-f67f-6cw9-8mq4 fix available via `npm audit fix --force` Will install hono@4.11.4, which is outside the stated dependency range node_modules/hono 1 high severity vulnerability To address all issues, run: npm audit fix --force ``` ## Related Issue   N/A ## Changes Made   - Upgrade Hono ## Testing Performed   - Tested on Chrome ## Checklist   - [X] I have tested these changes locally and they work as expected. - [X] I have added/updated tests that prove the effectiveness of these changes. - [X] I have updated the documentation to reflect these changes, if applicable. - [X] I have followed the project's coding style guidelines. - [X] I have addressed the code review feedback from the previous submission, if applicable. ## Additional Notes   --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 20:33:10 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#2269

No description provided.

Rows
Columns