JLSEC-2026-1218 libcurl had a flaw that when instructed to clear proxy authentication credentials which made it...

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them...

JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...

Successfully using libcurl to do a transfer over a specific HTTP proxy proxyA with Digest authentication and then changing the proxy host to a second one proxyB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to...

JLSEC-2026-1206

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. whil...

CVE-2026-15970

Summary: CVE-2026-15970 affects Consul Community Edition 1.20.1–2.0.2 and Consul Enterprise; an L7 intention authorization bypass occurs when a service proxy uses a custom public listener, allowing an authenticated mesh workload to access HTTP paths blocked by a path-based deny intention. Impact ...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Summary The Proxy Helper hono/proxy does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients. Details Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a...

HTTP Request Smuggling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling in the proxy process. An attacker can access connection-scoped or internal metadata by sending requests to an application that proxies responses from an origin...

NPM: Hono: Proxy Helper does not remove response headers listed in the `Connection` header

NPM: Hono: Proxy Helper does not remove response headers listed in the Connection header vulnerability discovered by ? in WordPress Npm hono versions = 4.7.0, 4.12.34...

GHSA-79QM-7RJ5-M7R9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Summary The Proxy Helper hono/proxy does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients. Details Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a...

HTTP Request Smuggling

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling in the proxy process. An attacker can access connection-scoped or internal metadata by sending requests to an application that proxies responses fro...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849

Hono (Web application framework) vulnerability: from versions 4.7.0–4.12.33, the Proxy Helper proxy() in hono/proxy does not remove response headers named by the origin’s Connection header, potentially exposing headers intended for the origin’s peer. Per RFC 9110, intermediaries must remove Conne...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

EUVD-2026-54579

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

Use of Less Trusted Source

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Use of Less Trusted Source via the IncomingRequest::isSecure function. An attacker can cause the application to incorrectly treat insecu...

SUSE CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in "stunnel" 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., "::ffff:127.0.0.1" or unspecified addresses "0.0.0.0", "::"...

Information Disclosure axios Dependency in Bamboo Data Center

This High severity Information Disclosure vulnerability was introduced in versions 10.2.20 and 12.1.8 of Bamboo Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an...