An application using Hono’s proxy helper may leak internal or connection‑specific metadata to clients. The proxy() function fails to remove headers listed in the origin’s Connection header, so hop‑by‑hop headers that are not part of the standard set can be forwarded to the client, exposing data that was intended only for the immediate peer. This behavior falls under CWE‑200, the general class of information‑disclosure weaknesses.

The vulnerability affects the Hono web application framework from version 4.7.0 up through 4.12.33. The fix was introduced in release 4.12.34.

The CVSS score is 3.7, indicating a low severity impact, and no EPSS score is available; the vulnerability is not listed in CISA’s KEV. An attacker can trigger the leak by directing a client request that is proxied by an application leveraging the flawed proxy helper. The attack requires no authentication or privileged access beyond the ability to use the application’s proxy feature, and the exposed headers can reveal sensitive connection information. While the potential for serious damage is limited, the information leakage could be valuable to an adversary conducting reconnaissance on the deployment.