CVE-2026-71849: Hono: Proxy Helper does not remove response headers listed in the `Connection` header

August 7, 2026

The Proxy Helper (hono/proxy) does not remove response headers named by the origin’s Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients.

References

github.com/advisories/GHSA-79qm-7rj5-m7r9
github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f
github.com/honojs/hono/releases/tag/v4.12.34
github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
nvd.nist.gov/vuln/detail/CVE-2026-71849

Code Behaviors & Features

Detect and mitigate CVE-2026-71849 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →