NPM: Hono: Proxy Helper does not remove response headers listed in the `Connection` header

NPM: Hono: Proxy Helper does not remove response headers listed in the Connection header vulnerability discovered by ? in WordPress Npm hono versions = 4.7.0, 4.12.34...

PT-2026-69104

Name of the Vulnerable Software and Affected Versions Hono versions 4.7.0 through 4.12.33 Description The Proxy Helper proxy function in hono/proxy fails to remove response headers specified by the origin's Connection header. According to RFC 9110 Section 7.6.1, intermediaries must remove header...

CVE-2026-71849: Exposure of Sensitive Information to an Unauthorized Actor

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...