CVE-2026-71849
Received Received - Intake

Proxy Response Header Disclosure in Hono Framework

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-71849
EUVD
EUVD-2026-54579

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
hono hono to 4.12.34 (exc)
hono hono 4.12.34
honojs hono 4.7.0
honojs hono 4.12.33
honojs hono From 4.7.0 (inc) to 4.12.34 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Hono's Proxy Helper function (versions 4.7.0 to 4.12.33) fails to remove response headers listed in the origin server's Connection header before forwarding responses to clients. This violates RFC 9110, which requires intermediaries to strip such headers to prevent disclosure of sensitive connection-scoped or internal metadata.

Detection Guidance

Check if your Hono version is between 4.7.0 and 4.12.33 by inspecting package.json or running npm list hono. If affected, review proxy middleware configurations and test responses from origins using the Connection header to see if unexpected headers are forwarded.

Impact Analysis

An attacker could receive response headers containing sensitive metadata that the origin server intended only for its immediate peer. This could expose internal connection details or other confidential information, though the impact is limited due to the low CVSS score (3.7).

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by exposing connection-scoped or internal metadata through response headers. If an application proxies responses containing sensitive headers (e.g., authentication tokens, internal routing details) that should only be visible to immediate peers, unauthorized clients may gain access to this data. This conflicts with requirements for data confidentiality and integrity under these regulations.

Mitigation Strategies

Upgrade Hono to version 4.12.34 or later. If upgrading is not immediately possible, review and modify proxy middleware to strip headers listed in the Connection header before forwarding responses, as required by RFC 9110.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart