Description
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
Published: 2026-08-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the WebSocket upgrade handling of the honojs node-server allows an unauthenticated attacker to trigger an unbounded memory leak by sending a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header. The missing header causes the server to keep the request object in a map and leave the upgrade promise pending, resulting in a resource leak that can grow without bound as more requests arrive. This depletion eventually exhausts memory and renders the service unavailable.

Affected Systems

The issue affects honojs node-server releases from version 2.0.0 up to and including 2.0.10. The fix is deployed in version 2.0.10 and later. Administrators using any of these versions should identify the installed package and plan an upgrade.

Risk and Exploitability

The CVSS v3.1 score of 5.3 reflects a moderate severity that primarily impacts availability. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network‑based, requiring only publicly accessible WebSocket upgrade endpoints; no authentication or privileged access is needed. Repeated exploitation can lead to service downtime via memory exhaustion.

Generated by OpenCVE AI on August 18, 2026 at 04:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the honojs node-server package to version 2.0.10 or later to apply the vendor‑provided fix.
  • Implement early validation of the Sec-WebSocket-Key header in the application layer or middleware so that malformed upgrade attempts are rejected before reaching the server logic.
  • Apply rate limiting or connection throttling on public WebSocket routes to reduce the chance of resource exhaustion from repeated invalid requests.
  • Set up monitoring and alerts for abnormal memory usage patterns to detect potential exploitation attempts promptly.

Generated by OpenCVE AI on August 18, 2026 at 04:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-9mqv-5hh9-4cgg Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
History

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-459
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 14 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Hono
Hono node-server
Vendors & Products Hono
Hono node-server

Thu, 13 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
Title @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Weaknesses CWE-401
CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Hono Node-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-14T16:45:25.711Z

Reserved: 2026-08-12T20:53:46.381Z

Link: CVE-2026-73565

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T18:18:19.103

Modified: 2026-08-14T17:20:33.593

Link: CVE-2026-73565

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-13T17:37:28Z

Links: CVE-2026-73565 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T04:45:04Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-459

    Incomplete Cleanup

  • CWE-770

    Allocation of Resources Without Limits or Throttling