Detections
Analytics

Echo: hono: security update to 4.12.34

low Tenable Self-Hosted Container Security Plugin ID 464739

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to
 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the
 origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields
 listed in a message's Connection header field before forwarding the message, in addition to the well known
 hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including
 Connection itself, from origin responses. A client may therefore receive response headers that the origin
 intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such
 headers, when an application proxies responses from an origin that declares additional, non standard
 headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
 (CVE-2026-71849)

Solution

Update the hono library and its related packages to version 4.12.34 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-71849

Plugin Details

Severity: Low

ID: 464739

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-71849

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 8/7/2026

Reference Information

CVE: CVE-2026-71849