Response Header Disclosure in Hono Web Application Framework

CVE-2026-71849

What is CVE-2026-71849?

The Hono Web Application Framework's Proxy Helper function contains a vulnerability where response headers specified in the Connection header by the origin are not removed before forwarding. This oversight can result in the exposure of internal metadata or connection-scoped information to clients, which walks against established standards outlined in RFC 9110. The issue arises when applications proxy responses from origins that declare additional non-standard headers in the Connection header. The vulnerability affects Hono versions 4.7.0 to 4.12.33 and is addressed in version 4.12.34.

References