v4.10.2

honojs/honov4.10.2Oct 21, 2025by yusukebe

AI Summary

This is a security-focused release (v4.10.2) that addresses an improper authorization vulnerability in Hono's JWT authentication middleware. The update adds RFC 7519-compliant audience (`aud`) claim validation through a new `verification.aud` configuration option, preventing potential cross-service access from token mix-up. The release also includes one test fix contribution from a new contributor.

Key Highlights

Security fix: Added audience (`aud`) claim validation to JWT middleware to prevent cross-service token access
New `verification.aud` configuration option enables RFC 7519-compliant audience validation
Applications using JWT middleware should now explicitly configure the audience for secure token validation
One test case fix contributed by new contributor @IAmSSH

New Features

New `verification.aud` option in JWT middleware for audience claim validation

Full Release Notes

## Security hardening improvement

If you are using JWT middleware, please read the following and consider applying the configuration.

### Improper Authorization in Hono (JWT Audience Validation)

Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).

The issue is addressed by adding a new `verification.aud` configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.

### Recommended secure configuration

You can enable RFC 7519–compliant audience validation using the new `verification.aud` option:

```ts
import { Hono } from 'hono'
import { jwt } from 'hono/jwt'

const app = new Hono()

app.use(
  '/api/*',
  jwt({
    secret: 'my-secret',
    verification: {
      // Require this API to only accept tokens with aud = 'service-a'
      aud: 'service-a',
    },
  })
)
```

## What's Changed
* tests: Fix test case of handlers without a path by @IAmSSH in https://github.com/honojs/hono/pull/4472

## New Contributors
* @IAmSSH made their first contribution in https://github.com/honojs/hono/pull/4472

**Full Changelog**: https://github.com/honojs/hono/compare/v4.10.1...v4.10.2