CVE-2026-71849: Hono Information Disclosure Vulnerability

CVE-2026-71849 Overview

CVE-2026-71849 is an information disclosure vulnerability in Hono, a web application framework for JavaScript runtimes. The flaw affects the proxy() function in hono/proxy from version 4.7.0 through 4.12.33. The Proxy Helper fails to strip response headers named by the origin's Connection header before forwarding responses to clients. Per RFC 9110 Section 7.6.1, intermediaries must remove such headers in addition to the well-known hop-by-hop headers. Clients may therefore receive connection-scoped or internal metadata that the origin intended only for its immediate peer. The issue is fixed in Hono version 4.12.34 and is classified under CWE-200.

Critical Impact
Applications proxying responses through Hono may leak connection-scoped or internal headers to downstream clients, exposing metadata the origin intended to keep private between peers.

Affected Products

Hono web framework versions 4.7.0 through 4.12.33
Applications using the hono/proxy Proxy Helper proxy() function
Downstream services relying on Hono as an HTTP intermediary

Discovery Timeline

2026-08-07 - CVE-2026-71849 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71849

Vulnerability Analysis

The vulnerability resides in Hono's Proxy Helper implementation in src/helper/proxy/index.ts. When Hono acts as a reverse proxy, it forwards responses from an origin server back to the client after stripping hop-by-hop headers. RFC 9110 Section 7.6.1 requires intermediaries to remove two categories of headers before forwarding: the well-known hop-by-hop headers (such as Connection, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, Upgrade) and any additional header names listed within the message's own Connection header value.

Hono's implementation only removed the first category. If an origin declared custom headers as hop-by-hop through the Connection response header (for example, Connection: close, X-Internal-Route, X-Backend-Session), those custom headers remained attached when Hono forwarded the response. Clients could then observe metadata the origin intended only for its immediate peer.

Root Cause

The root cause is incomplete adherence to RFC 9110 header forwarding rules. The proxy() function iterated a static list of hop-by-hop headers but never parsed the origin response's Connection header to dynamically extend the removal set. This oversight caused connection-scoped headers to survive the proxy hop.

Attack Vector

Exploitation requires an application built on Hono to proxy responses from an origin that emits sensitive information in headers marked as connection-scoped. An attacker who controls or observes traffic to the proxied endpoint can read the leaked headers. The attack complexity is elevated because it depends on the origin's specific header behavior and the sensitivity of the disclosed values.

typescript

// Patch from src/helper/proxy/index.ts
const res = await (customFetch || fetch)(req)
const resHeaders = new Headers(res.headers)

// https://datatracker.ietf.org/doc/html/rfc9110#section-7.6.1
// Remove headers listed in the response's own Connection header (MUST per RFC 9110)
const connectionValue = resHeaders.get('connection')
if (connectionValue) {
  connectionValue
    .split(',')
    .map((h) => h.trim())
    .filter((h) => ALLOWED_TOKEN_PATTERN.test(h))
    .forEach((h) => resHeaders.delete(h))
}

hopByHopHeaders.forEach((header) => {
  resHeaders.delete(header)
})

Source: Hono commit 720b566

Detection Methods for CVE-2026-71849

Indicators of Compromise

Client-visible response headers matching tokens listed in an upstream Connection header value
Presence of non-standard internal headers (for example, backend identifiers, session tokens, routing metadata) in responses served through a Hono proxy() route
Deployments running hono package versions between 4.7.0 and 4.12.33

Detection Strategies

Inventory application dependencies for hono versions in the affected range using software composition analysis tools
Capture and compare response headers between the origin and the client-facing proxy to identify headers that should have been stripped
Review Hono route definitions for calls to the proxy() helper and audit associated origin services for custom Connection header usage

Monitoring Recommendations

Log full response headers at the proxy boundary for services using Hono to detect anomalous header propagation
Alert on responses containing internal-only header prefixes (for example, X-Internal-, X-Backend-) reaching external clients
Track dependency updates in CI/CD pipelines to flag deployments still using vulnerable Hono versions

How to Mitigate CVE-2026-71849

Immediate Actions Required

Upgrade Hono to version 4.12.34 or later across all applications using the hono/proxy helper
Audit origin services behind Hono proxies to identify custom headers emitted via the Connection response header
Rotate any credentials or session identifiers that may have been exposed in proxied response headers

Patch Information

The fix is available in Hono v4.12.34. The patch adds logic to parse the response's Connection header, tokenize its values, and delete each named header before forwarding. Details are published in the GitHub Security Advisory GHSA-79qm-7rj5-m7r9 and the v4.12.34 release notes.

Workarounds

Wrap the proxy() call with middleware that explicitly deletes headers named in the upstream Connection response header before returning to the client
Configure origin services to avoid placing sensitive metadata in headers declared as connection-scoped
Restrict which origins may be reached through Hono proxy routes to reduce exposure of internal header content

bash

# Upgrade Hono to the patched version
npm install hono@^4.12.34

# Verify installed version
npm ls hono