EUVD-2026-54579
GHSA-79qm-7rj5-m7r9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N because leaked headers reach the client over the network; AC:H because exploitation depends on non-default origin behavior of declaring custom hop-by-hop headers; C:L for partial metadata disclosure with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 npm packages depend on hono (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.7.0.
DescriptionCVE.org
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
AnalysisAI
Hono's proxy() function in the hono/proxy Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's Connection response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm hono package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via Connection. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
Technical ContextAI
Hono is a lightweight, multi-runtime JavaScript/TypeScript web framework published as the npm package hono (CPE cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*). Its Proxy Helper submodule (hono/proxy) provides a proxy() function for acting as an HTTP intermediary. RFC 9110 Section 7.6.1 requires that any intermediary strip both the well-known hop-by-hop headers (e.g., Transfer-Encoding, TE, Connection) and any additional headers explicitly enumerated in the Connection header field of a response before forwarding it. The proxy() function handled the former set but ignored the latter: it never parsed the Connection value to extract and delete the custom header names listed there. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) captures the root cause - connection-scoped metadata intended only for the immediate peer escapes the proxy boundary and reaches the client. The fix (commit 720b566290793d4358bf39843adcb7cf4da4548f) adds a compliant parse-and-delete pass over the Connection header value before forwarding the response.
RemediationAI
Upgrade the hono npm package to version 4.12.34 or later, which contains the RFC 9110-compliant fix introduced in commit 720b566290793d4358bf39843adcb7cf4da4548f; the tagged release is available at https://github.com/honojs/hono/releases/tag/v4.12.34 and the full security advisory is at https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9. If an immediate upgrade is not feasible, a targeted compensating control is to configure origin servers to omit non-standard header names from their Connection response fields, ensuring only well-known hop-by-hop headers appear there; this requires control of the origin and may not be possible for third-party backends. Alternatively, an application-level middleware layer can be placed in front of the proxy() call to strip any headers listed in each Connection value before returning the response to clients, though this duplicates logic that the patch corrects at the source. Applications confirmed to proxy only origins that use standard hop-by-hop headers face no risk and are not affected.
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by
Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthen
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.3),
Hono is a Web application framework that provides support for any JavaScript runtime. Rated medium severity (CVSS 5.0),
Cross-user HTML disclosure in Hono's server-side rendering affects all applications using hono/jsx with memo()-wrapped c
Hono is a web framework written in TypeScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploita
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Hono versions before 4.11.4 allow JWT algorithm confusion attacks through improper algorithm validation in the JWK/JWKS
Hono before version 4.11.4 contains a JWT algorithm confusion vulnerability in its JWK/JWKS verification middleware that
Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middlew
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received fro
Header injection in Hono's CORS middleware exposes applications to cache key pollution across versions before 4.10.3. Wh
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today