Quick answers
- Is CVE-2026-71849 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-71849 being exploited in the wild.
- How severe is CVE-2026-71849?
- Low severity, with a CVSS score of 3.7, published 7 August 2026.
- Which products and versions are affected?
- hono (npm) >= 4.7.0, < 4.12.34, SEMVER:introduced=4.7.0,fixed=4.12.34.
- Is there a fix for CVE-2026-71849?
- Yes. hono (npm): upgrade to 4.12.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-71849 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-71849?
- Check whether you run hono (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- hono (npm): upgrade to 4.12.34 or later
npm install hono@4.12.34
Technical details
The Hono Proxy Helper (`hono/proxy`) violates RFC 9110 Section 7.6.1 by failing to remove headers designated as connection-scoped in the origin's `Connection` header field. While the `proxy()` function correctly removes standard hop-by-hop headers, it does not parse the `Connection` header to identify and strip additional non-standard headers declared by the origin. An attacker could potentially observe sensitive internal metadata or connection-specific information that was intended only for the intermediary proxy. This issue is specific to applications proxying origins that utilize custom hop-by-hop headers. The vulnerability is addressed in version 4.12.34.
Affected products
- honojs hono >= 4.7.0, < 4.12.34
Identifiers
- CVE-2026-71849
- GHSA-79qm-7rj5-m7r9
Timeline
- 2026-08-03: patched: Fixed in version 4.12.34
- 2026-08-07: advisory: GitHub Advisory GHSA-79qm-7rj5-m7r9 published