Executive brief
Hono is a web framework used to build applications and APIs. A vulnerability in its Proxy Helper component could allow sensitive internal information to be leaked to end-users. This occurs when the proxy fails to remove specific technical headers that were only intended for internal communication between servers, potentially exposing metadata about the internal network or infrastructure.
Technical details
The Hono Proxy Helper (`hono/proxy`) violates RFC 9110 Section 7.6.1 by failing to remove headers designated as connection-scoped in the origin's `Connection` header field. While the `proxy()` function correctly removes standard hop-by-hop headers, it does not parse the `Connection` header to identify and strip additional non-standard headers declared by the origin. An attacker could potentially observe sensitive internal metadata or connection-specific information that was intended only for the intermediary proxy. This issue is specific to applications proxying origins that utilize custom hop-by-hop headers. The vulnerability is addressed in version 4.12.34.
Affected products
- honojs hono >= 4.7.0, < 4.12.34
Timeline
- 2026-08-03: patched: Fixed in version 4.12.34
- 2026-08-07: advisory: GitHub Advisory GHSA-79qm-7rj5-m7r9 published