{"uuid": "d4cac5e1-ca66-4369-bf48-c7c5d85c9f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-79qm-7rj5-m7r9", "type": "seen", "source": "https://gist.github.com/alon710/5988f40586bcc25ff4d614f1ea49845f", "content": "# CVE-2026-71849: CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71849\n\n## Summary\nA vulnerability in the Hono framework's Proxy Helper allows the exposure of connection-scoped, internal, or session-specific metadata to unauthorized actors. The proxy helper fails to remove header fields dynamically listed in the response's Connection header, violating RFC 9110 Section 7.6.1.\n\n## TL;DR\nHono's proxy helper failed to dynamically strip custom connection-scoped headers specified in the response's Connection header, leading to information leakage of internal transit headers to clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Information Exposure\n- **Exploit Status**: None / Theoretical\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- hono\n- **hono**: >= 4.7.0, < 4.12.34 (Fixed in: `4.12.34`)\n\n## Mitigation\n\n- Upgrade Hono to version 4.12.34 or higher\n- Implement a manual middleware wrapper to parse and delete connection-scoped headers\n\n**Remediation Steps:**\n1. Identify all service entrypoints using `hono/proxy`\n2. Update package.json to require hono version 4.12.34 or above\n3. Execute npm install, yarn install, pnpm install, or bun install to apply the change\n4. Verify proxy responses no longer contain headers specified in the Connection header\n\n## References\n\n- [GitHub Security Advisory GHSA-79qm-7rj5-m7r9](https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9)\n- [Fix Commit](https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f)\n- [Hono Release v4.12.34](https://github.com/honojs/hono/releases/tag/v4.12.34)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71849)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71849) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:01:19.478125Z"}