[EdamAme-x]

The bitwise OR operator | 0 truncates numbers to 32-bit signed integers, causing overflow after 2038-01-19 when Unix timestamps exceed 2^31-1. This would make expired JWT tokens pass validation.

Replace (Date.now() / 1000) | 0 with Math.floor(Date.now() / 1000) and add a regression test that verifies expired tokens are correctly rejected when the current time is past the Y2038 boundary.

While this would typically be a severe vulnerability, it is not expected to occur for another 10 years, so I believe it poses no immediate issue.

PoC

// PoC: JWT Y2038
const _originalDateNow = Date.now
Date.now = () => 2147483648 * 1000 // 2038-01-19 03:14:08 UTC

import { Jwt } from 'hono/utils/jwt'

async function main() {
  const secret = 'my-secret'
  const token = await Jwt.sign({ sub: 'user', exp: 1735689600 }, secret, 'HS256')

  try {
    const payload = await Jwt.verify(token, secret, 'HS256')
    console.log('[VULN]:', payload)
  } catch (e) {
    console.log('[OK]:', (e as Error).message)
  }
}

main().finally(() => { Date.now = _originalDateNow })

Result

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code

[EdamAme-x]

I saw an actual instance of the Y2038 bug for the first time.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.48%. Comparing base (2de30d7) to head (374e332).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4754   +/-   ##
=======================================
  Coverage   91.48%   91.48%           
=======================================
  Files         177      177           
  Lines       11556    11556           
  Branches     3357     3357           
=======================================
  Hits        10572    10572           
  Misses        983      983           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[yusukebe]

LGTM!

[yusukebe]

@EdamAme-x

Hono will exist over 2038. Thanks!