CVE-2026-71849 in Hono
Summary
by MITRE • 08/07/2026
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in Hono web application framework versions 4.7.0 through 4.12.33 represents a critical security flaw in the proxy functionality that directly violates fundamental HTTP intermediary behavior requirements. The Proxy Helper's proxy() function fails to properly implement RFC 9110 Section 7.6.1 standards for connection handling, creating a significant information disclosure risk. This flaw occurs specifically within the hono/proxy module where the function processes responses from origin servers without correctly sanitizing headers according to established HTTP specifications.
The technical implementation error stems from incomplete header processing logic that only removes well-known hop-by-hop headers while neglecting to strip additional headers explicitly declared in the Connection response header by the origin server. This oversight allows headers that should remain connection-scoped and invisible to intermediate proxies to leak through to downstream clients. The vulnerability specifically impacts applications that utilize the proxy() function to forward responses from origins that declare custom headers as hop-by-hop via their Connection header field, creating a scenario where internal metadata becomes exposed to unauthorized parties.
From an operational perspective, this vulnerability enables attackers to potentially access connection-scoped information that should remain hidden between the origin server and the immediate proxy intermediary. The exposure of such metadata could include internal system identifiers, debugging information, or other sensitive connection-specific data that helps attackers understand the underlying infrastructure architecture. This information disclosure represents a significant risk for applications deployed in environments where such metadata could aid in further exploitation attempts or provide insights into system configurations.
The security implications align with CWE-200 (Information Exposure) and relate to ATT&CK technique T1592 (Resource Discovery) and T1046 (Network Service Scanning). Organizations using affected Hono versions should immediately upgrade to 4.12.34 or later, as this represents the first patched release that correctly implements RFC 9110 compliance for proxy header handling. The mitigation strategy involves not only updating the framework version but also conducting thorough security assessments of proxy configurations and monitoring for any potential exploitation attempts that might have occurred during the vulnerable period. Security teams should also review their network traffic analysis logs to identify any unusual patterns that might indicate unauthorized access to previously hidden connection metadata through this vulnerability.