CVE-2026-71849: 
JavaScript vulnerability analysis and mitigation

CVE-2026-71849 is an information disclosure vulnerability in the Hono web application framework's Proxy Helper (hono/proxy) module, where the proxy() function fails to strip response headers designated as connection-scoped by the origin's Connection header. This violates RFC 9110 Section 7.6.1, which mandates that intermediaries remove all headers listed in a message's Connection field before forwarding. The vulnerability affects Hono versions >= 4.7.0 and < 4.12.34 (npm package hono), and was published on August 3, 2026, with the advisory added to the GitHub Advisory Database on August 7, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Hono Security Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The proxy() function in src/helper/proxy/index.ts correctly removed well-known hop-by-hop headers (e.g., Connection, Transfer-Encoding) from origin responses, but did not parse the value of the Connection response header to identify and remove any additional, non-standard headers the origin declared as connection-scoped. The fix (commit 720b566) adds logic to split the Connection header value by comma, validate each token against ALLOWED_TOKEN_PATTERN, and delete those headers from the forwarded response before stripping the standard hop-by-hop set. Exploitation requires the proxied origin to actively declare custom headers in its Connection response header; applications proxying origins that only use standard hop-by-hop headers are not affected (Hono Security Advisory, Patch Commit).

Successful exploitation results in a limited confidentiality breach: clients may receive response headers that the origin server intended only for its immediate peer (e.g., the Hono proxy), potentially exposing connection-scoped or internal metadata such as internal session tokens, backend routing hints, or other non-standard headers. There is no impact on integrity or availability, and no evidence of lateral movement potential. The scope is limited to applications using hono/proxy to forward responses from origins that declare custom hop-by-hop headers via the Connection response header (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.0024 (0.24%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as it depends on the specific behavior of the proxied origin server declaring non-standard hop-by-hop headers (Github Advisory, Feedly).

1. Identify a target: Locate a web application built with Hono (versions 4.7.0–4.12.33) that uses the hono/proxy Proxy Helper to forward requests to a backend origin server.
2. Assess origin behavior: Determine whether the backend origin server includes custom, non-standard header names in its Connection response header (e.g., Connection: x-internal-token, x-session-id), which signals those headers are intended only for the immediate peer.
3. Send a proxied request: Issue an HTTP request to the Hono proxy endpoint that routes to the origin server with the custom Connection header behavior.
4. Observe leaked headers: Inspect the HTTP response received from the Hono proxy — headers listed in the origin's Connection field (e.g., X-Internal-Token) will be present in the forwarded response, exposing connection-scoped or internal metadata not intended for the client (Hono Security Advisory, Patch Commit).

Upgrade the hono npm package to version 4.12.34 or later, which includes the fix for this vulnerability. The patch was released on August 3, 2026, and adds RFC 9110-compliant stripping of headers listed in the origin's Connection response header before forwarding to clients. No configuration-based workaround is available; the only remediation is upgrading. Applications whose proxied origins do not declare custom hop-by-hop headers via the Connection response header are not affected and face no immediate risk (Hono Release v4.12.34, Github Advisory).

The advisory was published by Hono maintainer yusukebe and credited reporter morgan-coded for discovering the issue. The vulnerability was disclosed as part of a broader v4.12.34 security release that also addressed three other issues (cross-user data disclosure in hono/jsx, ReDoS in hono/cors, and DoS in hono/language), with the release receiving positive community engagement on GitHub. No significant independent researcher commentary or media coverage beyond the official advisory has been identified (Hono Release v4.12.34).