CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper
Vulnerability ID: CVE-2026-71849
CVSS Score: 3.7
Published: 2026-08-07
A vulnerability in the Hono framework's Proxy Helper allows the exposure of connection-scoped, internal, or session-specific metadata to unauthorized actors. The proxy helper fails to remove header fields dynamically listed in the response's Connection header, violating RFC 9110 Section 7.6.1.
TL;DR
Hono's proxy helper failed to dynamically strip custom connection-scoped headers specified in the response's Connection header, leading to information leakage of internal transit headers to clients.
Technical Details
- CWE ID: CWE-200
- Attack Vector: Network
- CVSS v3.1: 3.7 (Low)
- EPSS Score: Not Available
- Impact: Information Exposure
- Exploit Status: None / Theoretical
- KEV Status: Not Listed
Affected Systems
- hono
-
hono: >= 4.7.0, < 4.12.34 (Fixed in:
4.12.34)
Code Analysis
Commit: 720b566
fix(proxy): strip connection-scoped headers per RFC 9110 Section 7.6.1
Mitigation Strategies
- Upgrade Hono to version 4.12.34 or higher
- Implement a manual middleware wrapper to parse and delete connection-scoped headers
Remediation Steps:
- Identify all service entrypoints using
hono/proxy - Update package.json to require hono version 4.12.34 or above
- Execute npm install, yarn install, pnpm install, or bun install to apply the change
- Verify proxy responses no longer contain headers specified in the Connection header
References
Read the full report for CVE-2026-71849 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)