CVE-2026-71849: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in honojs hono
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
AI Analysis
Technical Summary
The honojs hono framework's proxy() function did not fully comply with RFC 9110 Section 7.6.1 regarding removal of hop-by-hop headers. Specifically, it removed well-known hop-by-hop headers but failed to remove additional headers named in the origin's Connection header. This allowed response headers intended only for the origin's immediate peer to be forwarded to clients, exposing potentially sensitive connection-scoped or internal metadata. The vulnerability affects versions from 4.7.0 up to but not including 4.12.34 and is resolved in version 4.12.34.
Potential Impact
Clients may receive response headers that were intended only for the origin server's immediate peer, potentially exposing sensitive internal or connection-scoped metadata. The confidentiality of some information may be compromised, but there is no impact on integrity or availability. The CVSS score of 3.7 reflects a low severity impact limited to information disclosure over the network with high attack complexity and no privileges required.
Mitigation Recommendations
Upgrade to hono version 4.12.34 or later where this issue is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor advisory stating the fix is included in version 4.12.34.
CVE-2026-71849: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in honojs hono
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
CVSS v3.1
Score 3.7low
Affected software
honojs
hono
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The honojs hono framework's proxy() function did not fully comply with RFC 9110 Section 7.6.1 regarding removal of hop-by-hop headers. Specifically, it removed well-known hop-by-hop headers but failed to remove additional headers named in the origin's Connection header. This allowed response headers intended only for the origin's immediate peer to be forwarded to clients, exposing potentially sensitive connection-scoped or internal metadata. The vulnerability affects versions from 4.7.0 up to but not including 4.12.34 and is resolved in version 4.12.34.
Potential Impact
Clients may receive response headers that were intended only for the origin server's immediate peer, potentially exposing sensitive internal or connection-scoped metadata. The confidentiality of some information may be compromised, but there is no impact on integrity or availability. The CVSS score of 3.7 reflects a low severity impact limited to information disclosure over the network with high attack complexity and no privileges required.
Mitigation Recommendations
Upgrade to hono version 4.12.34 or later where this issue is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor advisory stating the fix is included in version 4.12.34.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-07T18:26:53.523Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a762a7bbf8831d539f90bfe
Added to database: 08/07/2026, 18:56:59 UTC
Last enriched: 08/15/2026, 15:35:52 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.