npm/hono CVE-2026-71849: low 3.7, EPSS 0.36%

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Action: Upgrade hono to 4.12.34 or later.

npm i hono@4.12.34

Affected

Fixed versions

Sources

• osv: GHSA-79qm-7rj5-m7r9
• https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
• https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f
• https://github.com/honojs/hono
• https://github.com/honojs/hono/releases/tag/v4.12.34

CVE-2026-71849 · published 2026-08-07T18:38:48Z · modified 2026-09-10T03:51:13.317395159Z · JSON